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1«.  AbitrecfTA  , A irpori 

This  report  documents  work  performed  for  the  Federal  Aviation  Administration 
(FAA)  to  study^he  future  policy  Impact  Impllcatlohs  of  advanced  air  tra^lc_  tJ'.'J./i 
trol  (ATC)  systems  which  might  be  developed  by  thej|f  AA)  • The  study  -examine^  fmpacts 
of  ATC  automation  on  sector  air  traffic  controllers,  with  emphasis  placed  on  the 
Identl^catlon  of  human  factors  problems  that  may  arise  In  the  future  If  higher 
1 eve t:^u toms tlon^ are  Implemented.  Of  particular  concern  are  those  human  factors 
that  iMy  In  some' manner  determine  the  direction  of  automation  development  or  Impede 
the  Implementation  of  automation.  Questions  relating  to  the  feasibility  of  hard- 
ware and  software  design  ware  not  addressed;  automation  configuration  concepts  were 
assumed  to  be  technologically  feasible.  f^Ualng  descriptions  of  technological  compo- 
nents currently  proposed  by  the  FAA,  six  ATC  system  operations  were  defined.  These 
systems  represent  various  levels  of  automation  development  from  the  current  system 
to  a system  In  which  the  human  controller  acts  as  a systems  data  manager.  The 
systams  ware  evaluated  In  terms  of  17  factors  describing  Job  satisfaction  and  moti- 
vation, man-machine  Interface,  and  failure  mode  operations  In  order  to  Identify 
critical  operational  characteristics  for  each  system.  ^ 
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The  study  described  In  this  report  Is  part  of  a broad  effort  by  the 
Federal  Aviation  Administration  (PAA)  to  investigate  the  long-term  policy 
issues  and  potential  impacts  of  higher  levels  of  air  traffic  control  (ATC) 
automation.  The  broad  effort  is  concerned  with  identifying  and  determin- 
ing the  scope  of  problems  of  organizational  and  institutional  policy 
formulation  that  may  face  the  FAA  in  the  future.  This  research  is  a 
pilot  effort  to  investigate  the  human  factors  impacts  of  future  automa- 
tion on  sector  controllers.  The  research  examines  human  factors  influ- 
ences on  the  degree  to  which  ATC  automation  may  ultimately  be  developed, 
the  likely  paths  of  automation  transition,  and  the  types  of  controllers 
most  amenable  to  interface  with  highly  automated  operations. 


A.  Method  of  Approach 

Six  sector  control  operations  representing  the  current  ATC  system 
and  five  plausible  versions  of  future  automated  systems  were  defined, 
and  17  factors  describing  the  pertinent  performance  capabilities  of 
humans  were  selected.  Each  future  system  was  rated  relative  to  the 
present  system  in  terms  of  the  factors  by  a panel  of  FAA  and  other 
government  personnel  familiar  with  ATC. 


1.  System  Descriptions 


Descriptions  of  future  ATC  systems  were  developed  by  projecting 
logical  representatives  of  system  operating  functions  corresponding  to 
various  advanced  technology  configurations.  These  descriptions  were  based 
on  operational  characteristics  analogous  to  those  of  the  current  ATC 
system,  which  includes  National  Airspace  System  (NAS)  Stage  A and 
Automated  Radar  Terminal  (ARTS)  technologies.  Operational  descriptions 
were  developed  for  the  following  six  systems: 


• System  1 

• System  2 

• System  3 

• System  4 

• System  5 

• System  6 


NAS /ARTS 

Enroute  Decision  Aid  Automation 
Terminal  Decision  Aid  Automation 
Co.'ti.*ol-by-Exceptlon--Level  I 
Conttol-by-Exceptlon— Level  II 
Control-by-Exceptlon— Level  III. 
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a.  System  1;  NAS /ARTS —NAS /ARTS  operations  require  terminal 
and  enroute  controllers  to  perform  traffic  planning,  tacital  decision 
making,  and  clearance  issuance  functions.  Clearances  are  issued  by  the 
controllers  using  air/ground  (A/G)  voice  communications. 


b.  System  2:  Enroute  Decision  Aid  Automation— Enroute  deci- 
sion aid  automation  Incorporates  conflict  probe  and  related  technologies 
to  automate  tactical  decision  making  but  requires  enroute  controllers  to 
critically  review  the  computer-generated  tactical  decision-making  activi- 
ties. Clearances  are  issued  through  A/G  voice  communications. 


c.  System  3:  Terminal  Decision  Aid  Automation— Terminal 
decision  aid  automation  incorporates  metering  and  spacing  and  related 
technologies  to  automate  traffic  planning  and  tactical  decision-making 
functions  but  requires  terminal  controllers  to  critically  review  the 
computerized  traffic  planning  and  tactical  decision-making  activities. 
Clearances  are  issued  through  A/G  voice  comnunications. 


d.  System  4:  Control-bv-Exception--Level  I --  Control-by- 
exceptlon  (Level  I)  incorporates  control  message  automation  (CMA) , data 
link,  and  related  technologies  to  automated  traffic  planning,  tactical 
decision-making,  and  clearance  issuance  functions,  but  requires  terminal 
and  enroute  controllers  to  critically  review  the  computerized  planning 
actions  and  tactical  decision-making  and  clearance  issuance  activities. 
Clearances  are  automatically  processed  by  data  link. 


e.  System  5:  Control-bv-Exceptlon--Level  lI--Control-bv- 
exception  (Level  IX)  incorporates  the  same  basic  technologies  as  Level  I 
but  requires  controllers  to  maintain  cognizance  (i.e.,  without  critical 
review)  of  computerized  planning  actions  and  to  critically  review  com- 
puterized tactical  decision-making  strategies  without  reviewing  the 
details  of  the  automated  clearance  issuance  activities. 


f.  System  6:  Control-bv-Exception— Level  III— Control-bv- 
exceptlon  (Level  III)  Incorporates  the  same  basic  technologies  as 
Levels  I and  II  but  requires  controllers  to  maintain  the  computer  data 
base  without  maintaining  cognizance  or  critically  reviewing-computer 
generated  actions. 


2.  Human  Factors  Descriptions 

Human  factors  pertinent  to  ATC  operations  were  studied;  the  following 
17  factors  in  the  general  areas  of  job  satisfaction  and  motivation,  man- 
machine  intarface,  and  failure  mode  operations  were  selected  on  the  basis 
of  their  relevance  to  future  ATC  automation  issues: 


Iv 


Job  Satisfaction  and  Motivation 


10* 


1) 

Achievement — work  alignment 

2) 

Recognition 

3) 

Responsibility 

4) 

Control  authority 

5) 

Utilization  of  perieived 

skills 

6) 

Challenge — discretionary 

flexibility 

7) 

Performance  feedback 

8) 

Interest 

Man- 

-Machine  Interface 

9) 

Vigilance 

10) 

Stress 

11) 

Intricacy 

12) 

Restrictiveness 

13) 

Rigidity 

14) 

Decision  making 

Failure  Mode  Operations 

15) 

Failure  recognition 

16) 

Failure  recovery 

17) 

Failure  operations 

B.  Conclusions 

The  functional  descriptions  of  each  system  were  rated  relative  to 
the  human  factors  in  such  a manner  that  the  respondents  could  state  their 
evaluations  of  desirable  and  undesirable  job  elements.  Project  staff 
analyzed  the  resultant  rating  data  to  Identify  those  operational  charac- 
teristics of  ATC  systems  that  were  perceived  by  the  raters  as  significantly 
weak  or  strong.  The  results  of  this  analysis  are  described  In  the  main 
body  of  this  report;  a summary  of  our  conclusions  Is  presented  below. 

System  2 (Enroute  Decision  Aid  Automation)  was  found  to  be  the  most 
promising  of  the  future  systems  in  terms  of  compatabl 11 ty  between 
operational  design  and  human  factors.  The  conflict  probe  of  System  2 
would  enable  a controller  to  apply  expert  skills  to  critically  review 
computerized  actions  and  therefore  would  not  severely  limit  his  ability 
to  exercise  highly  trained  capabilities.  System  6 (Control-by-F.xception, 
Level  III),  In  which  a controller  Is  almost  completely  "out  of  the  loop" 
but  acts  as  the  overall  systems  manager,  would  be  acceptable  given  a 
radical  change  In  the  type  of  person  performing  the  Job  as  well  as  in 
the  training  he  receives.  This  of  course  assumes  technological  components 
of  such  quality  and  redundancy  that  a controller  could  be  removed  com- 
pletely from  the  tactical  ATC  situation. 

System  3 (Terminal  Decision  Aid  Automation),  System  4 (Control-by 
Exception,  Level  I),  and  System  5 (Control-by-Except Ion,  Level  II)  reduce 
the  opportunities  of  today's  controllers  to  apply  their  expert  skills,  and 
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thus  lead  Co  inconsistencies  between  human  expectations  and  rewards.  In 
these  systems,  highly  trained  control  skills  equivalent  Co  those  of  today's 
controllers  would  be  necessary  If  Che  controller  Is  expected  to  perform 
recovery  operations  in  Che  event  of  automation  failure.  Underutilization 
of  these  expert  skills,  caused  by  removing  Che  planning  functions  from 
Che  Job  responsibilities  of  controllers,  appears  Co  account  In  large 
part  for  reductions  In  Job  satisfaction  and  motivation  rewards.  Such 
underutilization  of  expert  skills  could  also  undermine  the  capabilities 
of  controllers  Co  respond  to  failures  regardless  of  Che  amount  of 
training  they  have  received. 

The  conclusions  discussed  above  are  based  on  a preliminary  research 
effort  that  requires  further  verification.  This  Initial  research  utilized 
a panel  of  raters  composed  of  Individuals  with  long  experience  In  air 
traffic  control  and  others  with  backgrounds  In  engineering,  medicine, 
psychology,  and  personnel.  A replication  of  Che  research  utilizing  a 
panel  composed  of  air  traffic  control  personnel  at  FAA  ATC  facilities 
would  be  desirable.  Also,  the  list  of  human  factors  involving  Job 
satisfaction  usee  In  this  research  omitted  such  considerations  as  Job 
advancement  potential,  financial  remuneration,  and  on-the-Job  Interpersonal 
relationships.  These  considerations  Involve  complexities  that  are  beyond 
the  scope  of  this  first-cut  analysis  and  were  therefore  not  Included. 
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I INTRODUCTION 


The  path  of  evolution  of  air  traffic  control  (ATC)  modernization  and 
automation  leads  to  increased  employment  of  sophisticated  system  technol- 
ogy. A number  of  engineering  and  operational  studies  have  predicted  that 
deployment  of  new  systems  hardware  and  software  will  have  a significant 
effect  on  J|he  way  control  services  are  performed  and  delivered  to  system 
users.'' These  techncloglral  developments  encompass  changes  to 
comnunlcations,  surveillance  and  navigation  procedures,  separation 
standards,  airspace  sectorization,  sector  control  equipment,  sector 
manning  strategies,  and  airspace  traffic  flow  regulations.  Analyses  of 
the  operational  potentials  of  various  technological  components  have 
resulted  in  proposals  for  future  system  designs.  These  ATC  system  plans 
include  the  Upgraded  Third  Generation  (UG3RD),'”^  Extended  UG3RD,*  and 
Advanced  Air  Traffic  Management  System  (AATMS)® ’®  concepts. 

Studies  of  the  operating  capability  of  various  systems  have  projected 
moderate  to  sizeable  gains  in  traffic  capacity  and  controller  productiv- 
ity.'”'® However,  the  successful  implementation  and  continued  operation 
of  future  ATC  systems  depend  not  only  on  the  resolution  of  technological 
problems  but  also  on  the  development  of  systems  that  are  compatible  with 
organizational  and  Institutional  processes.  Deployment  of  advanced 
technology  by  the  Federal  Aviation  Administration  (FAA)  will  probably 
require  modifications  to  the  agency's  organizational  behavior  in  order 
to  adjust  to  both  the  operational  characteristics  of  new  systems  and  the 
reactions  from  the  aviation  Industry,  the  public,  and  other  government 
agencies.  Therefore,  there  is  reason  to  believe  that  implementation  of 
new  ATC  systems  will  both  require  and  Induce  changes  in  the  processes  by 
which  the  FAA  functions.  Operational  impacts  would  be  felt  in  such  areas 
as  policy  review,  program  planning,  resource  allocation,  and  management 
of  ATC  services  and  regulatory  responsibilities. 

Although  most  studies  of  future  ATC  automation  have  concentrated  on 
questions  of  technological  and  operational  feasibility  a few  have  examined 
some  aspects  of  organizational  and  institutional  questions  by  addressing 
the  problem  of  human  behavior  in  automated  operations.'”^’'®  These  studies, 
however,  have  not  given  full  attention  to  the  possible  impacts  on  con- 
trollers of  future  automation  and  the  possible  human  and  other  organiza- 
tional limitations  to  the  successful  implementation  of  ATC  automation. 
Clearly,  additional  research  is  needed  to  determine  the  degree  to  which 
ATC  can  be  and  should  be  automated. 

In  response  to  the  concerns  stated  above,  the  study  described  in 
this  report  was  undertaken. 


A list  of  references  is  attached  to  this  report, 
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A.  Oblectlves  and  Scope 


This  study  Is  a pilot  effort  to  develop  methodology  and  guidance  for 
further  analysis  of  future  automation  policy  Issues  and  preliminary  Infor- 
mation describing  possible  problem  areas.  The  scope  of  the  study  was  re- 
stricted to  human  factors  Issues  relating  to  the  Impacts  of  ATC  automa- 
tion on  sector  controllers.  The  emphasis  of  the  research  was  on  Identi- 
fying problems  that  may  arise  In  the  future  If  higher  levels  of  automation 
are  Implemented.  Of  particular  concern  were  those  human  factors  Issues 
that  may  In  some  manner  determine  the  direction  or  Impede  the  Implementa- 
tion of  automation.  Questions  relating  to  the  feasibility  of  automation 
hardware  and  software  design  were  not  addressed;  automation  configuration 
concepts  were  assumed  to  be  technologically  feasible. 


B.  Method  of  Approach 

The  study  was  designed  as  a first-cut  analysis  of  the  role  human 
controllers  might  have  In  future  operational  environments.  The  analysis 
focused  on  the  Interactions  between  humans  and  various  automation  concepts 
so  that  human  capabilities  and  limitations  could  be  better  understood. 

This  approach  was  Intended  to  broaden  Insights  Into  human  factors  Issues 
concerning  the  degree  to  which  ATC  automation  may  ultimately  be  developed, 
the  desirable  paths  of  automation  transition,  and  the  types  of  human  con- 
trollers most  amenable  to  Interface  with  highly  automated  operations. 

To  search  for  and  identify  relevant  issues,  the  project  team  developed 
a methodology  to  evaluate  the  human  factors  consequences  of  future  automa- 
tion, Plausible  ATC  systems  that  could  be  examined  for  their  effects  on 
human  factors  were  developed.  For  each  system,  functional  descriptions  of 
future  automated  operations  were  compared  with  17  human  factors,  and  the 
system  operations  were  subjectively  rated  relative  to  these  factors.  The 
rating  procedure  was  designed  as  a series  of  critical  questions  that 
tested  such  human  factors  as  motivation,  achievement,  responsibility, 
challenge,  stress,  and  the  like  against  a set  of  specific  automation 
functions.  The  questions  enabled  persons  familiar  with  ATC  operations 
to  rate  their  perception  of  the  degree  of  Importance  of  each  human  factor 
for  specific  ATC  environments. 

The  ratings  were  performed  by  government  personnel  using  system 
functional  descriptions,  factor  descriptions,  and  rating  forms  developed 
by  the  project  team.  Project  personnel  administered  the  rating  exercise 
and  reduced  and  analyzed  the  data  but  did  not  participate  In  the  rating. 


1 . System  Descriptions 

Project  personnel  developed  descriptions  of  future  ATC  systems  by  pro- 
jecting logical  representations  of  system  operating  functions  corresponding 
to  various  advanced  technology  configurations.  The  descriptions  of  future 
systems  are  hypothetical  but  are  based  on  extensions  of  ATC  automation 
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currently  being  pr jposed  or  developed  by  the  FAA  and  on  related 
studies^  of  advanced  ATC  system  designs  and  operating  strategies. 

These  advanced  systems  assume  an  evolutionary  deployment  of  new  technol- 
ogy anu  the  continuation  of  the  current  philosophy  of  ground-based  air 
traffic  management  with  a high  degree  of  tactical  and  strategic  control 
automation.  The  high  levels  of  automation  allow  the  human  operator  to 
function  as  an  air  traffic  monitor  and  manager  rather  than  as  a con- 
troller of  minute-by-minute  air  traffic  events. 

Past  studies  have  discussed  the  role  of  man  as  a manager,  but  not 
at  the  level  of  descriptive  detail  needed  to  perform  the  human  factors 
analyses  required  for  this  research.  Therefore,  project  personnel  in- 
corporated and  integrated  the  technological  descriptions  contained  in 
these  studies  and  projected  alternative  operating  modes  for  both  human 
operators  and  automation.  The  system  descriptions  developed  represent 
alternative  design  concepts  that  are  being  considered  for  future  imple- 
mentation; they  do  not  represent  official  FAA  views  and  positions. 

Changes  to  the  current  concepts  of  technological  development  should  not 
significantly  affect  the  outcome  of  this  tudy,  however,  because  the  sys- 
tems analyzed  are  representative  of  technology  trends. 

Six  automated  sector  control  operations  were  identified  including  the 
current  ATC  system  and  five  future  systems.  The  future  systems  were 
postulated  by  configuring  various  automation  components  proposed  by  the 
FAA^"*  into  advanced  systems  whose  operational  characteristics  are  analogous 
to  current  systems.  The  analogies  were  based  in  part  on  available  documen- 
tation of  operational  concepts and  in  part  on  operational  knowledge 
accumulated  through  a series  of  previous  ATC  studies that  included 
on-site  observations  of  FAA  enroute  and  terminal  control  facilities. 

Three  of  the  future  ATC  systems  were  collectively  referred  to  as 
control-by-exceptlon*  operations.  These  assumed  the  use  of  automatic  con- 
trol message  generation  and  transmission  technology.  In  control-by- 
exceptlon  systems,  sector  controllers  can  Intervene  in  the  computerized 
control  operation  when  they  take  exception  to  or  disagree  with  the 
automation's  Intended  actions.  The  three  control-by-exceptlon  systems 
were  defined  according  to  three  distinct  levels  of  human  intervention 
capability;  the  most  advanced  system  allows  virtually  no  human  interven- 
tion and  direction. 

The  two  remaining  future  systems,  enroute  and  terminal  decision  aid 
automation,  represent  intermediate  technological  developments  that  might 
precede  control  by  exception.  These  two  systems  could  be  part  of  a 
time-phased  evolution  from  the  current  ATC  system  to  a control-by-exceptlon 
system,  although  such  evolutionary  deployment  is  not  a necessary  premise 
for  this  study.  The  technological  components  of  the  six  ATC  systems  are 
described  in  Section  II  of  this  report. 


*The  term  "control-by-exceptlon"  is  not  an  official  FAA  identifier  for  any 
system,  but  it  Is  In  popular  use.  Other  terms,  such  as  "man-as-the-manager ," 
are  equally  appropriate. 
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The  operation  of  each  ATC  system  was  described  in  terms  of  the  con- 
trol processes  required  to  perform  traffic  planning  and  tactical  control 
services.  The  control  processes  were  subdivided  Into  a set  of  30  con- 
trol functions,  each  of  which  must  be  performed  by  a human  or  by  the 
automation  mechanism.  Project  personnel  developed  unique  descriptions  of 
control  operations  for  each  system  by  assigning  specific  functions  to 
either  a human  operator  or  a machine  depending  on  the  automation  composi- 
tion of  the  system  The  development  of  the  control  function  descriptors 
for  the  six  ATC  systems  is  described  In  Section  III  of  this  report;  Appen- 
dixes A through  F contain  additional  operational  details  for  each  system. 


2.  Human  Factors  Descriptions 

Seventeen  factors  were  Identified  to  describe  pertinent  performance 
capabilities  and  limitations  of  human  controllers.  These  factors  address 
Job  satisfaction  and  motivation,  man-machine  interface,  and  failure  mode 
operations.*  The  factors  were  developed  with  the  aid  of  project  staff 
psychologists  using  previous  studies  for  reference  and  guidance. 

Each  of  the  17  factors  was  defined  In  terms  of  the  degree  to  which  a job 
situation  Is  conducive  to  effective  human  performance.  These  factors 
are  listed  in  Section  IV  of  this  report  and  described  In  detail  in 
Appendix  G. 


3.  Rating  Mechanism 

Project  staff  devised  the  rating  forms  (scoring  questionnaires)  with 
which  system  operations  were  evaluated.  One  form  was  designed  for  each 
system  In  such  a way  that  30  control  functions  could  be  quantitatively 
rated  relative  to  the  17  factors.  The  critical  factor  and  function  pair 
comparison  mechanism  Is  conceptually  Illustrated  in  Figure  1. 

The  forms  were  filled  out  by  20  respondents,  each  of  whom  was  a 
staff  member  from  FAA  headquarters,  the  National  Aviation  Facilities 
Experimental  Center  (NAFEC),  or  the  Transportation  Systems  Center  (TSC). 
The  respondents  were  given  Instructions,  rating  guidelines  for  each 
factor,  control  function  descriptions  for  each  ATC  system  alternative, 
and  the  rating  forms  and  were  asked  to  rate  numerically  (on  a scale  of 
1 to  5)  certain  functions  against  specified  factors.  This  format  was 
designed  to  solicit  the  respondent's  judgment  of  the  degree  to  which  a 
control  function  contributes  to  desirable  or  undesirable  aspects  of 
human  performance. 

Section  IV  of  this  report  includes  a brief  summary  of  the  rating 
procedure  (described  in  detail  in  Appendix  H)  and  presents  an  overview 
of  the  rating  data  results  (tabulated  In  Appendix  I). 


*Failure  mode  is  the  means  by  which  an  ATC  system  operates  when  one  or 
more  components  do  not  function  such  that  the  controller  must  compensate 
for  the  functional  failure. 
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4,  Rating  Data.  Analysis,  and  Conclusions 


SRI  used  computer  data  processing  to  compile,  aggregate,  and  organize 
the  rating  data;  Identify  rater  biases;  and  develop  rating  statistics  for 
analysis.  The  analysis  identified  those  factors,  functions,  or  factor  and 
function  pairs  that  were  Judged  by  the  respondents  to  be  the  most  critical 
items  of  future  automation  development.  The  current  ATC  operation  was 
included  in  this  rating  exercise  to  provide  a comparative  basis  for 
analyzing  critical  items  and  criticality  trends  for  progressively  higher 
levels  of  automation. 

Section  V of  this  report  Includes  descriptions  of  the  data  analysis; 
conclusions  developed  from  the  analysis  are  presented  In  Section  VI. 
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II  ATC  TECHNOLOGY 


This  section  reviews  the  technologies  leading  to  and  including 
control-by-exceptlon  automation.  The  specific  technological  components 
considered  are  the  items  included  as  part  of  the  FAA's  Upgraded  Third 
Generation  Automation  (UG3RD)  program  (see  Table  1).  The  UC3RD  program 
represents  the  current  plans  for  future  ATC  technological  development 
and  is  subject  to  revision  as  more  information  is  obtained  concerning 
automation  potentials  and  need.  However,  the  UG3RD  technological  com- 
ponents are  representative  of  the  levels  of  automation  likely  to  be 
available  in  the  future  and  are  therefore  useful  for  analyzing  the  im- 
pact of  future  automation  on  sector  controllers. 

The  data  link  and  control  message  automation  components  in  Table  1 
are  the  technological  bases  for  control-by-exception  systems  operations. 
The  intermediate  components  are  potential  predecessors  to  a control-by- 
exceptlon  system  in  that  they  could,  in  theory,  be  implemented  before 
control-by-exceptlon,  assuming  an  evolutionary  program  for  technological 
development.  However,  it  is  possible  that  some  components,  such  as  me- 
tering and  spacing  (M&S),  may  not  precede  control-by-exception  but  rather 
be  Incorporated  into  the  control  message  automation  logic. 


A.  Technological  Component  Descriptions 

To  develop  a conceptual  perspective  on  the  operational  implications 
of  the  various  technological  components  listed  in  Table  1,  the  opera- 
tional potentials  of  these  components  are  described  below.  The  descrip- 
tions are  based  on  part  on  available  descriptions  of  each  component  ^ 
and  in  part  on  observations  of  ATC  operations." 


1 . Current  Technology 
a.  NAS/ARTS 


The  current  enroute  NAS  Stage  A and  terminal  ARTS  III  ATC  opera- 
tions Include  alr/ground  (A/G)  and  interphone  voice  communications;  au- 
tomated flight  data  processing  and  forwarding;  air  traffic  control  radar 
beacon  system  (ATCRBS);  automatic  tracking  displays  with  alphanumerics 
(including  Mode  C and  reported  altitudes  and  ground  speed);  automatic 
and  manual  display  filters;  surveillance  data  mosaicing  (enroute  only); 
simplified  clearance/coordination  procedures;  conflict  alert;  minimum 
safe  altitude  warning  (MSAW) ; and  central  flow  control.  The  ARTS  III 
system  directly  supports  terminal  radar  approach  control  (TRACON)  oper- 
ations; the  alphanumeric  display  features  are  available  in  various  air- 
port tower  cabs. 
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Table  1 

AUTOMATION  TECHNOLOGY 


Automation  Level 

TechnoloKlcal  Component 

Current 

NAS /ARTS;  conflict  alert 

Minimum  safe  altitude  warning  (MSAW) 

Intermediate 

Airport  surface  traffic  control  (ASTC) 

Wind  shear  advisory 

Wake  vortex  avoidance  system  (WVAS) 
Automated  data  handling  (AOH) 

Microwave  landing  system  (MLS) 

Area  navigation  (RNAV) 

Conflict  probe 

Metering  and  spacing  (M&S) 

Enroute  metering 

Automated  local  flow  control  (LFC) 
Automated  central  flow  control  (CFC) 

Advanced 

Control  message  automation  (CMA) 

Data  link 

Discrete  address  beacon  system  (DABS) 
Automatic  traffic  advisory  and  resolu- 
tion system  (ATARS) 
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Sector  operations  in  enroute  centers  and  In  TKACONs  focus  on  the 
radar  (R)  controller.  This  critical  decision  maker  performs  the  separa- 
tion assurance  and  flight  path  management  activities  and  may  be  supported 
by  other  controllers.  Control  task  activities  include  A/G  voice  coninun- 
icatlons  (R  controller  only);  flight  strip  processing  manual  operations; 
intersector  (Including  interfacility)  interphone  voice  communications  (R 
controller  only) ; computer  data  entry  and  display  manual  processing;  and 
intrasector  direct  voice  consultations.  Surveillance  of  plan  view  dis- 
play (PVD)  aircraft  situation,  identity,  and  related  alphanumeric  data 
enables  controller  flight-following.  Controllers  mentally  project  flight 
trajectories  to  detect  and  assess  potential  conflicts  and  resolve  these 
conflicts  by  issuing  clearances  using  A/G  communications.  Traffic  flow 
organisation  and  structuring  are  conducted  in  accordance  with  established 
procedural  rules,  which  may  be  adjusted  when  local  flow  control  opera- 
tions are  instituted. 

Local,  ground,  and  related  control  operations  in  towers  use  aircraft 
situation  data  obtained  by  direct  observation  and  voice  communications. 
Radar  displays  support  situation  surveillance  operations. 


b.  Conflict  Alert 


Conflict  alert  detects  minimum  separation  violations  just  prior  to 
their  occurrence  and  accordingly  warns  the  controller  (suggested  resolu- 
tions are  not  included) . Since  this  device  operates  on  imminent  poten- 
tial conflict  situations  that  occasionally  may  be  "missed"  by  the  con- 
trollers, it  does  not  have  an  impact  on  controller  thought  processes 
that  ordinarily  occur.  The  conflict  alert  is  a very  useful  safety  en- 
hancement that  supplements  the  fundamental  thought  processes  of  controller 
decision  making. 


c . Minimum  Safe  Altitude  Warning  (MSAW) 

MSAW  automatically  advises  sector  controllers  of  an  aircraft  flying 
or  projected  to  fly  below  safe  altitude  limits.  MSAW  is  a very  useful 
safety  enhancement  that  supplements  the  basic  controller  decision-making 
logic. 


2 . Intermediate  Technology 

a . Airport  Surface  Traffic  Control  (ASTC) 

ASTC  will  introduce  advanced  surveillance  display  capabilities  to 
the  tower  controller.  Current  plans  call  for  implementing  ASTC  at  some 
major  airports.  Although  this  feature  will  facilitate  controller  sur- 
veillance and  reduce  communication  workload,  basic  decision-making  logic 
will  not  be  changed  by  ASTC  implementation. 
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b. 


Wind  Shear  Advisory 


Wind  shear  advisory  will  use  ground  sensors  and  computerized  algo- 
rithms to  Identify  dangerous  wind  shear  situations  In  the  vicinity  of 
rutiways  (especially  approaches)  and  to  advise  local  and  approach  con- 
trollers accordingly.  The  wind  shear  advisory  Is  a very  useful  safety 
enhancement  but  Is  not  expected  to  alter  controller  decision-making 
logic. 


c .  Wake  Vortex  Avoidance  System  (WVAS) 

WVAS  will  detect  or  predict  conditions  of  wake  vortices  behind 
large  and/or  heavy  aircraft  during  low  speed  on  final  approach  or  de- 
parture. Resulting  safety  improvements  and  possible  reduced  aircraft 
separation  requirements  should  increase  runway  capacities.  The  impact 
of  WVAS  on  controller  decision-making  logic  will  depend  on  whether  man- 
ual or  automated  systems  are  Implemented.  Manual  WVAS  will  advise  local 
and  approach  controllers  of  wake  vortex  existence  but  inherently  will 
not  affect  controller  decision-making  logic.  Automated  WVAS  will  rec- 
ommend specific  spacing  rules  for  a given  aircraft  pair  that  must  be  as- 
similated by  the  controller  into  his  thought  process.  The  assimilation 
by  the  controller  of  externally  generated,  dynamically  changing,  separa- 
tion rules  represents  a departure  from  the  current  mode  of  operation  and 
could  require  adjustments  to  the  controller  decision-making  logic.  (The 
questions  of  how  and  to  what  degree  such  adjustments  would  be  made  are 
beyond  the  scope  of  this  study  and  are  topics  for  further  research.) 


d .  Automated  Data  Handling  (ADH) 

ADH  Includes  the  implementation  of  enroute  and  terminal  sector  con- 
trol positions  of  an  electronic  tabular  flight  data  display  subsystem 
(ETABS)  and  a terminal  information  processing  system  (TIPS).  The  tabu- 
lar display,  an  electronic  flight  data  presentation  designed  to  replace 
paper  flight  strips  and  attendant  manual  activities,  automates  flight 
data  distribution  between  sectors  and  facilities.  With  inclusion  of 
touch  entry  data  processing,  the  resulting  reduction  in  control  workload 
per  aircraft  would  Increase  sector  traffic-handling  capabilities.  The 
tabular  display  with  touch  entry  capabilities  would  facilitate  informa- 
tion processing  by  the  controller  but  is  not  expected  to  alter  controller 
decision-making  logic. 


e.  Microwave  Landing  System  (MLS) 

MLS  is  Intended  to  upgrade  the  landing  service  of  the  current  in- 
strument landing  system  (ILS)  by  providing  multiple-glide  slope  and 
curved  approach  capabilities.  These  capabilities  may  lower  site  prepar- 
ation cost,  allow  MLS  installation  at  sites  where  ILS  is  not  practical, 
and  reduce  ground  noise,  but  they  will  have  no  impact  on  the  basic  con- 
troller decision-making  logic  (i.e.,  the  current  thought  processes  would 
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still  be  required  to  control  landing  aircraft,  although  there  may  be  a 
greater  selection  of  approach  paths) . 


f .  Area  Navigation  (RNAV) 

RNAV  avionics  and  ATC  Interface  automation  could  be  used  to  achieve 
direct  routing  and  closely  spaced  multilane  traffic  routes.  The  fre- 
quency of  occurrence  of  potential  conflict  situations  could  be  reduced 
by  placing  successive  aircraft  on  the  closely  spaced  parallel  routes; 
hence,  sector  controllers  could  be  relieved  of  some  conflict  resolution 
work.  However,  alterations  to  the  basic  declslon-maklng  logic  are  not 
envisioned  (l.e.,  the  current  thought  processes  would  still  be  required 
to  move  traffic  and  resolve  conflicts,  although  there  may  be  fewer  con- 
flict situations). 


g.  Conflict  Probe 


Conflict  probe  advises  sector  controllers  of  potential  conflict 
situations  and  recommends  resolution  actions  but  operates  over  a sig- 
nificantly longer  prediction  horizon  than  the  conflict  alert.  To  pro- 
vide an  operationally  realistic  time  prediction  horizon,  we  assume  this 
feature  will  be  used  when  aircraft  ent^r  a sector.  Workload  reductions 
would  reduce  the  conflict  detection  and  assessment  control  task  activ- 
ity; A/G  communications  would  still  be  required  to  transmit  resolution 
instructions.  Because  a controller  would  need  to  assimilate  the  con- 
flict probe's  assessment  and  resolution  recommendations  into  his  thought 
processes,  changes  in  current  controller  declslon-maklng  logic  will  be 
necessary.  (The  questions  of  how  and  to  what  degree  such  changes  in 
logic  would  be  made  are  topics  for  further  research.) 


h.  Metering  and  Spacing  (M&S) 

H&S  Is  a terminal  ATC  device  designed  to  maximize  airport  runway 
use  through  precise  control  of  interarrival  times  at  runway  thresholds. 
Suggested  control  Instructions  on  aircraft  headings,  speeds,  and  alti- 
tude would  be  issued  to  TRACON  controllers  by  the  computerized  metering 
and  sequencing  operation.  Some  workload  reductions  might  be  realized 
because  of  the  reduction  In  controller  decision  times  needed  to  assess 
and  determine  aircraft  sequence  assignment  and  the  reduction  of  poten- 
tial conflicts  along  inbound  flight  paths.  However,  the  process  by 
which  the  controllers  assimilate  the  M&S  recommendations  Into  their 
thought  processes  implies  a need  for  sector  controllers  to  adjust  their 
current  decision-making  logic.  (The  method  and  degree  of  such  adjust- 
ment are  topics  for  further  research.) 

Current  UG3RD  program  concepts  define  three  levels  of  M6cS--baslc, 
refined,  and  advanced.  Basic  M&S  operates  on  airport  arrival  traffic; 
refined  extends  basic  M&S  by  including  departures  and  multiple  air- 
ports in  complex  terminal  areas.  For  the  purposes  of  this  research. 
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basic  M&S  will  not  be  considered  since  it  is  a part  of  refined  M&S . Ad- 
vanced M&S  incorporates  data  link  coosnunications,  which  we  treat  as  part 
of  control-by-exception  automation. 


i.  Enroute  Metering 

Enroute  metering,  sn  extension  of  terminal  M&S,  would  require  en- 
route controllers  to  set  up  aircraft  spacings  in  accordance  with  time- 
varying  terminal  metering  specifications.  Sector  controllers  would  need 
to  respond  to  flow  control  procedural  restrictions  in  much  the  same 
fashion  as  they  now  respond,  but  facility  flow  controllers  would  need  to 
adjust  their  current  decision-making  logic  to  conform  to  the  enroute 
metering  operation.  (The  method  and  degree  of  such  adjustment  are  topics 
for  further  research.) 


J . Automated  Local  Flow  Control  (LFC) 

Automated  LFC  is  designed  to  maximize  utilization  of  sector  capa- 
city by  smoothing  out  traffic  peaking  situations.  It  would  govern  traf- 
fic flow  on  routes  by  means  of  an  on-line  computerized  traffic  planning 
process  that  regulates  workload  surges  in  accordance  with  the  traffic- 
handling  capabilities  of  a multisector  environment.  By  constraining 
traffic  peaks  and  their  concurrent  workload  surges,  LFC  may  be  capable 
of  regulating  congestion  and  alleviating  delays.  As  in  the  case  of  en- 
route metering,  sector  controllers  would  need  to  respond  to  flow  control 
procedural  restrictions  in  much  the  same  fashion  as  they  now  respond, 
but  facility  flow  controllers  would  need  to  adjust  their  current  decision- 
making logic  to  conform  to  the  local  flow  control  operation.  (The  method 
and  degree  of  such  adjustment  are  topics  for  further  research.) 


k.  Central  Flow  Control  (CFC) 

Automation  will  introduce  a dynamic  on-line  data  update  capability 
into  current  CFC  and  related  operations.  The  resulting  improvement  in 
traffic  demand  estimation  for  major  terminals  and  along  major  corridors 
would  support  the  other  terminal  and  enroute  flow  metering  and  manage- 
ment components  and  possibly  affect  decision-making  logic  at  the  facility 
flow  controller  level.  (The  method  and  degree  of  impact  are  topics  for 
further  research.) 


3.  Advanced  Technology 

a . Control  Message  Automation  (CMA) 

Q1A  components  are  the  bases  of  the  control-by-exception  operation 
where  the  controller  would  become  a system  manager  who  is  not  routinely 
engaged  in  all  aspects  of  minute-by-minute  tactical  decision  making  but 
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rather  responds  to  specific  situations  of  Interest.  The  computerized  CMA 
operation  will  transmit  to  pilots  such  digital  data  as  clearances  and  con- 
flict avoidance  directives.  These  transmissions  would  be  compatible  with 
Che  enroute  and  terminal  metering  and  flow  management  operations. 

A controller  may  Interface  with  CMA  In  several  ways--for  example, 

(1)  he  may  review  and  critically  assess  specific  clearances  and  adviso- 
ries recommended  by  the  computer  operation;  (2)  he  may  review  and  crit- 
ically assess  only  the  control  strategies  being  used  by  the  computer 
operation;  or  (3)  he  may  concentrate  on  maintaining  and  updating  the  CMA 
data  base  and  not  perform  any  review  and  critical  assessment  of  opera- 
tions. Considerable  adjustments  need  to  be  made  to  the  controller 
decision-making  logic  to  conform  to  the  CMA  operation.  (The  method  and 
degree  of  such  adjustments  are  topics  for  further  research.) 


b .  Data  Link 

Clearances  and  advisori.os  generated  by  the  CMA  operation  will  be 
transmitted  to  aircraft  digitally,  rather  than  through  voice  communica- 
tion by  controllers. 


c .  Discrete  Address  Beacon  System  (DABS) 

DABS  surveillance,  as  an  alternative  to  current  ATCRBS,  is  intended 
to  provide  high-reliability,  high-accuracy,  and  high-capacity  aircraft 
situation  data  acquisition  capabilities  necessary  to  support  control-by- 
exception automation.  Data  link  capability  is  inherent  in  the  DABS  de- 
sign and  is  an  alternative  to  independent  VHF/UHF  data  link. 


d .  Automatic  Traffic  Advisory  and  Resolution 
Service  (ATARS) 

ATARS  provides  traffic  advisories  and  t’  reat  avoidance  commands  to 
pilots  as  needed.  Since  this  service  could  operate  on  out-of-the- 
ordlnary  Imminent  conflict  situations,  it  is  analogous  to  the  conflict 
alert  except  that  commands  are  transmitted  by  means  of  data  link.  ATARS 
would  serve  as  a back-up  to  an  advanced  ATC  system.^ 


B.  Alternative  Technological  Configurations 

As  a first  step  toward  defining  system  configurations,  the  techno- 
logical components  described  in  Section  II. A were  classified  according 
to  the  type  of  automation  service  they  provide  and  their  operational  ap- 
plication (see  Table  2).  Information  aids  are  those  components  that  en- 
hance the  quality  or  quantity  of  the  information  used  by  controllers  or 
facilitate  data  processing  without  necessarily  changing  the  character  of 
a controller's  thought  processes  (l.e.,  decision-making  logic).  Decision 
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Table  2 


AUTCmTION  APPLICATIONS 


Automation  Service 


Operational  Appl 

Sector  Traffic  Control  f 


teat  ion 

Facility  Flow  Control 


Information  aids 


Airport  surface  traffic 
control  (ASTC) 


Wind  shear  advisory 


Manual  wake  vortex 
avoidance  system  (WVAS) 

Automated  data  handling  (ADH) 


Microwave  landing  system  (MLS) 

Area  navigation  (RNAV) 

Discrete  address  beacon  system 
(DBAS)  surveillance 


Decision  aids 


Conflict  probe 
Automated  WVAS 

Refined  metering  and 
spacing  (M&S)  ‘ 


Enroute  metering 

Automated  local  flow 
control  (LFC) 

Automated  central 
flow  control  (CFC) 


Decision 

automation 


Control  message  automation 
(CMA) 


Da  ta  1 ink 

Automatic  traffic  advisory  and 
resolution  system  (ATARS) 
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aids  begin  to  affect  a controller's  thought  processes  by  recommending 
decisions  or  conclusions.  Decision  automation  enables  controllers  to 
remove  themselves  to  varying  degrees  from  the  decision-making  logic  and 
therefore  is  the  technological  genesis  of  control-by-exception  opera- 
tions . 

Although  the  classification  of  technological  components  in  Table  2 
is  a useful  first  step  toward  defining  system  configurations,  further 
consideration  of  operational  requirements  is  necessary.  For  example, 
Information  aids,  as  a group,  may  be  defined  as  one  configuration,  but 
this  configuration  is  not  of  major  interest  to  this  research  because 
operational  processes  would  not  change  significantly  (other  than  con- 
troller manual  dexterity  needs  for  operating  with  touch  entry  data  pro- 
cessing rather  than  keyboards  and  flight  strips).  Major  impacts  of  in- 
formation aids  on  personnel  characteristics  and  qualifications  require- 
ments are  not  foreseen;  therefore,  information  aid  automation  will  not 
be  examined  as  an  independent  system  configuration. 

Decision  aids  are  applicable  to  two  operations;  enroute  and  ter- 
minal ATC.  The  enroute  configuration  would  consist  of  the  conflict 
probe,  enroute  metering,  LFC  '■.nd  CFC,  and  predecessor  enroute  informa- 
tion aid  automation.  The  terminal  configuration  would  consist  of  re- 
fined M&S,  automated  WVAS,  CFC,  and  the  predecessor  terminal  informa- 
tion aid  automation. 

The  decision  automation  components--CMA,  data  link,  and  ATARS--are 
common  to  both  enroute  and  terminal  environments,  but  various  strategies 
may  be  conceived  to  use  these  components  in  a control-by-exception  system. 

As  a result  of  the  above  observations,  and  with  the  aim  of  further 
developing  alternative  ATC  system  concepts,  the  following  technological 
configurations  have  been  devised  (see  Table  3): 

• NAS /ARTS 

• Enroute  decision  aid  automation 

• Terminal  decision  aid  automation 

• Control-by-exception. 

Note  that  these  configurations  are  defined  for  the  purposes  of  this 
research.  They  are  intended  as  investigative  demonstrations  of  the  dif- 
ferent ways  in  which  automation  might  be  implemented  and  are  not  meant 
to  represent  FAA-spec  if  led  configuration  designs.  For  the  purposes  of 
this  study,  ImplemenLCtlon  of  the  components  is  assumed,  but  the  timing 
and  extent  of  implementation  have  not  been  determined. 
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Table  3 

ALTERNATIVE  AIR  TRAFFIC  CONTROL 
SYSTEM  CONFIGURATIONS 


Configuration 

Technological  Component 

NAS /ARTS 

NAS  Stage  A 

ARTS  III 

Conflict  alert 

Minimum  safe  altitude  warning  (MSAW) 

Enroute 
decision  aid 
automation 

NAS 

+ Information  aids 
+ Conflict  probe 
+ Enroute  metering 

+ Automated  local  flow  control  (LFC) 

+ Automated  central  flow  control  (CFC) 

Terminal 
decision  aid 
automation 

ARTS 

+ Information  aids 

+ Refined  metering  and  spacing  (M6iS) 

+ Automated  wake  vortex  avoidance  system  (WVAS) 

+ Automated  central  flow  control  (CFC) 

Control-by- 
exce  pt ion 

Enroute/terminal  decision  aid  automation 
+ Control  message  automation  (CMA) 

+ Data  link 

+ Automatic  traffic  advisory  and  resolution 
service  (ATARS) 
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HUMAN  CONTROLLER  AND  AUTOMATION  ROLES 


In  this  section  a description  of  the  sector  ATC  operation  Is  devel- 
oped and  the  roles  played  by  human  operators  and  computer  for  current  and 
future  technological  configurations  are  postulated. 


A.  Sector  Control  Processes 

The  sector  ATC  operation  is  primarily  concerned  with  servicing  sep- 
aration assurance  requirements  and  secondarily  with  servicing  the  expe- 
ditious movement  of  aircraft  along  their  respective  flight  paths.  The 
sector  control  operation  can  be  described  as  a set  of  logic  processes 
that  are  followed  by  controllers  In  order  to  carry  out  their  decision- 
making functions.  The  operation  is  structured  into  a set  of  procedures, 
operation  rules,  and  responsibility  assignments  to  provide  the  flight 
services.  Based  in  part  on  observations  of  FAA  control  facility  op- 
erations and  In  part  on  the  analytical  requirements  of  this  research, 
the  basic  processes  of  sector  control  were  conceptualized  as  follows 
(see  Figure  2): 

Sector  traffic  flow  planning 
Aircraft  flight  path  planning 
Separation  assurance  decision  making 
Flight  information  decision  making 
Control  message  transmission. 


1.  Sector  Traffic  Flow  Plajininjj 

Sector  traffic  flow  planning  is  the  process  by  which  the  overall 
procedural  plan  for  organizing  and  moving  traffic  tiirough  a terminal  or 
enroute  sector  is  defined.  The  sector  traffic  flow  plan  Is  a specifica- 
tion of  the  preferred  routing  and  associated  altitude,  speed,  and  spacing 
restrictions  required  within  the  sector  and  at  sector  boundaries.  The 
sector  traffic  flow  plan  Is  set  up  In  response  to  changes  in  the  circum- 
stances under  which  the  sector  Is  to  operate  and,  as  such,  conforms  to 
constraints  imposed  by  sector  ATC  equipment  operating  status  (e.g.,  VOR 
outage,  runway  closure);  weather  status  (e.g.,  wind  direction,  frontal 
activity,  turbulance);  traffic  congestion;  and  external  procedural  con- 
straints (i.e.,  flow  control  route  restrictions,  or  altitude,  speed, 
and'ln-trall  spacing  restrictions  at  sector  exit  boundaries).  A sector 
traffic  flow  plan  designed  to  satisfy  the  above  changes  may  prescribe 
route  diversions  around  weather  front  activity,  tunneling  routes  under 
other  congested  routes,  a revised  airport  approach  and  departure  plan 


FIGURE  2 SECTOR  AIR  TRAFFIC  CONTROL  PROCESSES 
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for  ■ new  wind  direction,  or  altitude  and  speed  controls  for  facility 
flow  control.  A sector  traffic  flow  plan  established  for  one  sector  may 
Impoec  procedural  constraints  on  an  adjacent  sector;  that  is,  a sector 
traffic  flow  plan  maj^Nlnclude  altitude  and  speed  controls  on  Incoming 
aircraft  at  sector  entl^ ^boundaries  that  must  be  observed  by  the  upstream 
sectors. 

« 

2.  Aircraft  Flight  Path  Planning 

Aircraft  flight  path  planning  Is  the  process  by  which  the  flight 
trajectory  Intentions  for  aircraft  coming  Into  a sector  are  finalized 
and  made  to  conform  with  the  sector  traffic  flow  plan.  The  flight  path 
plan  may  coincide  with  the  computer-filed  flight  plan  (as  requested  by 
the  pilot  or  as  cleared  through  upstream  control  sectors)  or  as  a modi- 
fication to  the  computer-filed  flight  plan.  Such  modifications  are  made 
to  fit  the  aircraft  Into  the  current  sector  traffic  flow  plan.  For  ex- 
ample, routing  and  procedural  restrictions  associated  with  route  diver- 
sions around  weather  front  activity,  tunneling  under  congested  routes, 
reversed  airport  approach  and  departure  operations  for  a new  wind  direc- 
tion, or  altitude  and  speed  controls  for  flow  control  may  be  In  conflict 
with  the  computer-filed  flight  plan.  In  such  cases,  a new  flight  path 
plan  Is  defined  which  preempts  the  filed  plan  but  meets  the  route,  alti- 
tude, and  speed  restrictions  of  the  sector  traffic  flow  plan. 

The  sector  traffic  flow  and  aircraft  flight  path  planning  processes 
provide  preliminary,  or  first-cut,  separation  services  In  that  they  pre- 
clude the  development  of  untenable  traffic  congestion  situations.  The 
impienentatlon  of  altitude  and  speed  restrictions  often  serves  to  pro- 
cedurally  separate  flows  of  traffic  and  thereby  prevents  subsequent  con- 
gestion situations  where  mlnute-by-mlnute  separation  of  individual  air- 
craft would  be  extremely  difficult. 


3.  Separation  Assurance  Decision  Making 

Separation  assurance  decision  making  Is  the  process  by  which  Indi- 
vidual aircraft  are  kept  free  of  conflicts  with  other  aircraft.  The 
tracks  and  projected  trajectories  of  aircraft  are  monitored  to  detect 
potential  future  pairwise  violations  of  separation  rules  between  aircraft. 
The  process  operates  by  following  Individual  aircraft  on  a continual 
basis  rather  chan  by  monitoring  aggregate  traffic  flows  and  congestion 
situations.  The  Intention  Is  to  guarantee  the  safe  movement  of  the  air- 
craft along  the  next  segment  of  Its  flight  trajectory  by  clearing  the 
aircraft  from  point  to  point  along  Its  flight  path  plan.  Where  a pair- 
wise separation  violation  Is  projected,  a flight  path  modification  Is 
necessary  to  resolve  the  potential  conflict  situation.  The  conflict 
resolution  action  may  be  tactlcal--whereby  flight  trajectories  are  time 
separated  by  precisely  controlling  vectoring,  speed,  or  altitude  maneu- 
vers--or  proceduraI--whereby  flight  paths  are  spatially  separated  by  as- 
signing nonintersecting  routes  or  altitudes.  The  separatloi  sssurance 
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decision-making  process  results  in  the  selection  of  specific  clearances 
and  advisories  for  subsequent  transmission  to  aircraft. 


4.  Flight  Information  Decision  Making 

Flight  information  decision  making  is  the  process  by  which  the  data 
needs  of  individual  aircraft  are  served  after  separation  assurance  is 
performed.  This  process  identifies  control  requirements  that  have  not 
been  satisfied  by  the  separation  assurance  process  for  routinely  moving 
aircraft  along  conflict-free  flight  segments  (i.e.,  where  potential  con- 
flicts are  not  in  existence)  and  for  the  issuance  of  additional  instruc- 
tional or  advisory  Information  (e.g.,  A/G  frequency  change,  weather  data, 
airport  operational  situation,  navigational  Instruction).  The  flight 
information  decision-making  process  results  in  the  selection  of  specific 
clearances  and  advisories  for  subsequent  transmission  to  aircraft. 


5.  Control  Message  Transmission 

Control  message  transmission  is  the  process  by  which  specific  clear- 
ances and  advisories  are  Issued  to  aircraft  and  pilot  responses  are  re- 
ce ived . 

The  sector  control  processes  described  above  are  simplifications  of 
real-world  sector  control  operations,  and  they  segregate  certain  control 
actions  that  are  actually  performed  in  an  integrated  manner.  However, 
the  processes  were  defined  so  that  their  descriptions  not  only  include 
and  represent  the  primary  operational  requirements  of  sector  traffic  con- 
trol but  also  are  amenable  to  subsequent  analyses  of  automation  impact. 

In  particular,  each  control  process  definition  lends  itself  to  the  for- 
mulation of  system  descriptions  that  distinguish  the  operational  activi- 
ties of  the  human  controller  and  the  computer. 


B.  Alternative  Systems  Operations 

On  the  basis  of  the  control  process  definitions  presented  above  and 
the  technological  configurations  developed  in  Section  II,  the  following 
alternative  systems  of  sector  control  operations  were  defined; 


• System  1 

• System  2 

• System  3 

• System  4 

• System  5 

• System  6 


NAS /ARTS 

Enroute  Decision  Aid  Automation 
Terminal  Decision  Aid  Automation 
Control-by-Exceptlon  (Level  I) 
Control-by-Exception  (Level  II) 
Control-by-Exceptlon  (Level  III). 
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These  systems  were  developed  by  specifying  plausible  control  process  re- 
sponsibilities fcr  the  human  controllers  for  each  technological  config- 
uration and  by  considering  alternative  means  of  using  the  control-by- 
exception technology.  We  describe  below  the  primary  role  of  the  controller 
in  the  control  processes  for  each  system.  Table  4 suomarizes  these  roles 
and  shows  an  evolution  of  Increasing  levels  of  automation  sophistication 
and  responsibility  beginning  with  the  NAS/ARTS  system. 


NAS /ARTS - -The  controller  performs  the  decision-making  requirements 
of  each  control  process  (except  for  the  automated  conflict  alert  and  MSAW 
searches  for  emergencies) . 


Enroute  Decision  Aid  Automat  ion- -The  controller  continues  as  the 
primary  operational  planner  but  calls  on  the  conflict  probe  to  search  and 
assess  potential  conflicts. 


Terminal  Decision  Aid  Automat  ion- -The  controller  critically  reviews 
sector  traffic  flow  plans,  aircraft  flight  path  plans,  and  separation  as- 
surance and  flight  information  clearances  and  advisories  recommended  by 
the  computer  operation  (in  which  M&S  is  the  dominant  automation  technol- 
ogy). The  controller  Issues  all  clearance  and  advisories  by  means  of 
voice  A/G  radio  conniunications . 


Control-by-Exception  (Level  I) --The  controller  critically  reviews 
sector  traffic  flow  planning,  aircraft  flight  path  planning,  and  separa- 
tion assurance  clearances  and  advisories  recommended  by  the  control  mes- 
sage transmission.  In  this  process,  the  controller's  attention  is  cen- 
tered on  planning  operations  and  on  the  details  of  the  critical  separation 
assurance  activities;  he  does  not  critically  assess  the  computerized  flight 
information  decision-making  process.  Clearance  and  advisories  are  issued 
by  data  link,  except  for  those  few  messages  requiring  voice  relay  by  the 
human  (e.g.,  communications  with  non-data-link  aircraft) . 


Control-by-Exception  (Level  II) --The  controller  reviews  (without 
critical  assessment)  and  accepts  the  computer-recommended  sector  traffic 
flow  and  aircraft  flight  path  plans  (i.e.,  he  maintains  cognizance  of  the 
planning  operations  without  directing  them).  The  controller  critically 
reviews  the  strategies  recommended  by  the  control  message  transmission; 
he  does  not  review  and  assess  the  specific  clearance  and  advisories  as- 
sociated with  automated  separation  assurance  and  flight  information  de- 
cision making.  His  attention  is  concentrated  on  the  critical  separation 
assurance  events,  although  the  detailed  control  message  requirements  are 
not  evaluated.  Clearances  and  advisories  are  issued  by  data  link,  except 
for  those  few  messages  requiring  voice  relay. 
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OVERVIEW  OF  HUMAN  CXINTROLLER  ROLES 
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No  htaan  controller  Involvement 


Control-by-Exceptlon  (Level  III) --The  controller  is  removed  from  all 
review  and  assessment  operations.  He  processes  data  not  otherwise  acces- 
sible by  the  computer  operation,  monitors  conflict  alerts,  and  occasion- 
ally relays  voice  messages  when  appropriate. 


C.  Control  Functions 


Each  control  process  was  described  at  a level  of  detail  that  allowed 
an  analysis  of  the  specific  items  of  compatibility  between  the  human  con- 
troller and  the  computer.  Thus,  each  process  was  divided  into  component 
subprocesses  called  "control  functions,"  which  are  sets  of  control  actions 
that  may  be  performed  by  the  controller  or  the  computer,  depending  on  the 
specific  technological  configuration  under  consideration.  Table  5 pre- 
sents the  control  functions  and  their  allocations  for  each  of  the  six 
alternative  systems. 

The  control  processes  and  functions  for  each  system  are  described  in 
detail  in  Appendixes  A through  F.  It  is  recommended  that  the  reader  re- 
view the  appended  material  to  appreciate  the  underlying  thought  processes, 
manual  activities,  and  data  transfer  transactions  required  by  the  control- 
ler and  the  computer  for  each  system.  The  material  in  Appendixes  A through 
F was  given  to  the  raters  as  part  of  the  system  descriptions  used  for  hu- 
man factors  assessment.  The  raters  were  also  given  more  detailed  descrip- 
tions of  each  control  function.  These  descriptions,  which  are  not  in- 
cluded in  this  report,  parallel  the  control  function  summaries  included 
in  Appendixes  A through  F. 
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lodlcatc*  MO  or  womon  funccloa  pcrforaod  by  huwin);  PuDrtInn*  ' 16  pertain  to  interrupt iona  to  routine  cuncrol  actWtr<#«  hy 

Indicatcs  sutottation  (i.e.,  function  perfoneed  by  cosputer).  the  cenfUci  alert,  aucooatlr  traffic  adviaory  and  resolution  service  (ATAXS) , 

and  nlnlBun  safe  sllituda  warnint  (HSAU)  autoewtioo. 


IV  RATING  DATA 


In  order  to  rate  the  alternative  ATC  systems  and  control  process 
functions,  17  factors  were  Identified  In  the  areas  of  Job  satisfaction 
and  motivation,  man-machine  interface,  and  failure  mode  operations  (see 
below).  Human  factors  psychologists  and  personnel  specialists  partici- 
pated in  defining  these  factors  and  in  designing  a scoring  metric.  In 
addition,  previous  work  in  the  field  of  general  and  controller  human 
factors  was  used  for  reference. 

Job  Satisfaction  and  Motivation 

1.  Achievement --work  alignment 

2.  Recognition 

3.  Responsibility 

4.  Control  authority 

5.  Utilization  of  perceived  skills 

6.  Challenge--discretlonary  flexibility 

7.  Performance  feedback 

8.  Interest 

Man-Machine  Interface 

9.  Vigilance 

10.  Stress 

11.  Intricacy 

12.  Restrictiveness 

13.  Rigidity 

14.  Decision  making 

Failure  Mode  Operations 

15.  Failure  recognition 

16.  Failure  recovery 

17.  Failure  operations 

A host  of  job  satisfaction  and  motivation  factors  in  addition  to 
those  listed  above  are  relevant  to  the  general  study  of  the  impacts  of 
automation  on  human  controllers.  Such  factors  as  opportunity  for  ad- 
vancement, interpersonal  relations  with  peers  and  supervisors,  working 
conditions,  personal  life,  and  salary  were  not  included  because  the 
complexity  of  the  analysis  required  was  beyond  the  scope  of  this  pre- 
liminary research  into  human  factors  issues. 
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A , Rating  Procedure 

The  20  raters  were  given  a rating  form  for  each  system  and  were  in- 
structed to  score  selected  control  functions  relative  to  particular  fac- 
tors as  specified  on  the  forms.  The  scoring  was  made  using  an  Integer 
rating  scale,  or  metric,  ranging  from  1 to  5.  The  lowest  rating  value, 

1,  represents  the  least  desirable  Job  environment;  the  highest  rating 
value,  5,  represents  the  most  desirable  job  environment.  The  factors 
and  rating  procedures  are  described  In  Appendix  G;  sample  rating  forms 
for  each  system  are  Included  In  Appendix  H. 


B.  Rating  Data  Results 

The  rating  scores  were  processed  by  computer  to  obtain  the  average 
responses  of  the  sample  set  of  raters.  The  resulting  human  factors  aver- 
age ratings  for  each  function  of  each  system  are  summarized  In  Appendix 
I.  These  raw  data  were  further  processed  to  account  for  Individual  bi- 
ases when  some  raters  responded  consistently  with  very  high  or  low  scores 
while  others  did  not.  The  average  ratings  were  adjusted  to  remove  the 
effects  of  Individual  biases,  and  the  unbiased  average  ratings  presented 
In  the  graphs  In  Figures  3,  A,  and  5 were  obtained.  A mathematical  state- 
ment of  the  bias  adjustment  calculations  Is  included  in  Appendix  J. 

The  graphs  In  Figures  3,  A,  and  5 show  the  perceptions  of  the  raters 
In  regard  to  human  factors  as  automation  Increases.  (Recall  that  In- 
creases In  ratings  represent  Increasingly  desirable  job  environments.) 

The  average  ratings  for  job  satisfaction  and  motivation  (Figure  3)  are 
generally  highest  for  System  1 (NAS/ARTS)  and  usually  decrease  as  each 
succeeding  system  Is  examined.  Conversely,  the  ratings  for  man-machine 
Interface  (Figure  A)  are  lowest  for  System  1 (for  all  factors  except 
factor  11)  and  generally  constant  or  higher  for  each  succeeding  system. 

The  ratings  for  failure  mode  operations  (Figure  5)  show  less  consistent 
trends . 
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FACTOR  1:  ACHIEVEMENT—  FACTOR  2:  RECOGNITION 
(WORK  ALIGNMENT 


FACTOR  3:  RESFONSIBILITY  FACTOR  4:  CONTROL 

AUTHdRITY 


FACTOR  6:  SKILL  UTILIZATION  FACTOR  S:  CHALLENGE 


133466  123466 

SYSTEM  SYSTEM 


FACTOR  7;  FEEDBACK  FACTOR  8:  INTEREST 

FIGURE  3 ADJUSTED  AVERAGE  RATINGS  FOR  EACH  ATC  SYSTEM: 
JOB  SATISFACTION  AND  MOTIVATION 
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FACTOR  11:  INTRICACY  (Raduction) 


FACTOR  12:  RESTRICTIVENESS  (Raductionl 


FIGURE  4 ADJUSTED  AVERAGE  RATINGS  FOR  EACH  ATC  SYSTEM: 
MAN-MACHINE  INTERFACE 
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FACTOR  15;  FAILURE  RECOGNITION 


FACTOR  16;  FAILURE  RECOVERY 


1 2 3 4 6 6 


SYSTEMS 

FACTOR  17:  FAILURE  OPERATIONS 

FIGURE  6 ADJUSTED  AVERAGE  RATINGS  FOR  EACH  ATC  SYSTEM; 
FAILURE  MODE  OPERATIONS 


V DATA  ANALYSIS 


The  approach  selected  to  analyze  the  rating  data  involved  comparing 

the  five  proposed  future  systems  with  the  NAS/ARTS  system.  The  ratings 

given  to  each  control  function  were  examined  to  identify  critical  factor 
and  function  pairs  for  each  system.  The  significance  of  these  pairs  in 
terms  of  both  the  overall  control  process  and  the  role  of  the  controller 
in  future  systems  was  analyzed.  The  observations  discussed  below  were 
derived  from  the  analysis. 

Some  factors  were  rated  similarly  in  all  systems  and  therefore  were 

judged  to  be  "not  significant"  in  terms  of  automation  impact.  Such  fac- 

tors Include  control  authority,  feedback,  decision  making,  restrictiveness, 
intricacy,  and  rigidity. 

The  automation  of  a monitoring  or  decision-action- function  results 
in  an  Immediate  and  significant  reduction  in  the  rating  of  certain  job 
satisfaction  and  motivation  factor8--recognition,  responsibility,  skill 
utilization,  challenge,  and  interest.  This  rating  reduction  is  most 
often  accompanied  by  a significant  decrease  in  stress,  as  the  controller 
relinquishes  personal  responsibility  for  the  performance  of  a task  to 
the  computer. 

In  Systems  2 and  3 (Enroute'  and  Terminal  Decision  Aid  Automation) 
and  System  4 (Control-by-Except ion.  Level  I),  the  decision-action  func- 
tion is  automated  but  the  controller  still  performs  a manual  assessment 
function,  such  as  reviewing  and  revising  computer  output,  tactical  clear- 
ances and  advisories,  or  strategy.  The  reduction  in  ratings  of  job  sat- 
isfaction and  motivation  factors  caused  by  automating  decision-action 
functions  is  compensated  for  by  the  relatively  high  ratings  for  the  man- 
ual assessment  functions  In  effect,  the  raters  may  bo  Indicating  that 

a controller  would  recei  as  much  satisfaction;  feel  as  much  challenge, 

interest,  and  responsibility;  and  use  the  same  skills  for  reviewing  and 
revising  the  computer  as  when  he  performed  the  original  unautomated 
function  The  raters  also  considered  the  assessment  function  less  stress- 
ful than  the  original  monitoring  or  decision-action  function  perhaps  due 
to  their  perception  of  a computer  as  a vigilant,  tireless  monitor  that 
is  well  equipped  to  apply  logical  rules  to  certain  decisions. 

For  the  separation  assurance  process,  raters  probably  felt  that  the 
manual  assessment  function  of  revising  a computer's  recommended  strategy 
and  tactical  decisions  for  avoiding  conflict  was  almost  as  stressful  as 
when  a controller  makes  those  decisions  himself.  However,  in  the  area 
of  Job  satisfaction  and  motivation,  a controller  derives  a sense  of  re- 
sponsibility, challenge,  and  interest  from  revising  and  reviewing  the 


computer's  decisions.  A sense  of  recognition  is  gained  from  revising  a 
computer's  plans;  recognition  was  not  rated  as  high  for  reviewing  a com- 
puter's plans. 


The  high  ratings  given  to  job  satisfaction  and  motivation  factors 
because  of  manual  assessment  functions  are  reduced  as  the  revision  task, 
is  eliminated  in  System  5 (Control-by-Exceptlon,  Level  II)  and  the  re- 
view task  is  eliminated  in  System  6 (Control-by-Exceptlon.  Level  III). 

The  raters  were  concerned  with  equipment  failure  only  in  the  highly 
critical  separation  process  in  System  6 where  the  controller  may  not  be 
cognisant  of  the  tactical  traffic  situation. 

The  remainder  of  this  section  reviews  the  procedures  and  analyses 
used  to  develop  the  above  observations. 


A . Identification  of  Critical  Factor  and  Function  Pairs 


The  control  function  composition  of  each  system  changes  as  succes- 
sive levels  of  automation  are  developed  (see  Table  5).  Using  System  1 
(NAS/ARTS)  as  a basis  for  comparison,  each  function  of  System  1 is  either 
modified  or  eliminated  as  future  systems  with  more  automation  evolve;  in 
Some  cases,  new  functions  not  present  in  System  I are  added  for  the  fu- 
ture systems.  To  identify  meaningful  impacts  of  the  new  systems  on  the 
17  human  factors,  the  adjusted  (unbiased)  average  ratings  for  the  func- 
tion and  factor  pairs  (derived  from  the  raw  data  presented  in  Appendix  I) 
were  examined. 

The  pairwise  factor-function  ratings  in  System  1 were  used  as  the 
baseline,  and  the  maximum  rating  change  of  a factor  and  function  pair 
between  System  1 and  any  othev  system  was  identif ied--that  is,  the  arith- 
metic difference  between  a system  factor  and  function  pair  rating  and  a 
corresponding  rating  (if  scored)  for  each  of  the  other  systems  was  cal- 
culated and  the  greatest  absolute  value  of  these  differences  was  defined 
as  the  maximum  rating  change.  The  resultant  maximum  rating  changes  were 
found  to  be  distributed  blmodally;  exactly  half  of  the  maximum  rating 
changes  were  less  than  1 in  absolute  value.  This  distribution  was  Judged 
to  be  significant  because  a score  change  of  1 or  more  ensures  that  a 
rater's  perception  of  the  pair  has  shifted  subs tant la  1 ly-- in  fact  to  a 
different  level  on  the  rating  scale.  In  addition,  concentrating  on  the 
remaining  critical  pairs  makes  the  analysis  much  more  tractable  (an  im- 
portant consideration  when  a great  deal  of  data  is  being  analyzed). 

The  factor  and  function  pairs  with  maximum  rating  changes  equal  to 
or  greater  than  1 (relative  to  System  1 scores)  were  defined  as  critical. 
However,  this  criterion  does  not  consider  certain  functions  that  are  in- 
troduced into  Systems  2 through  6 as  automation  is  increased  and  whose 
ratings  could  not  be  arithmetically  compared  with  those  of  System  1 be- 
cause of  a lack  of  correspondence  in  functional  descriptions.  In  such 
cases,  any  new  function  that  causes  a rater  to  rate  a factor  very  high 
or  very  low  would  be  significant;  those  functions  eliciting  only  ambiv- 
alent responses  would  not  be.  Therefore,  a second  criterion  for  criti- 
cality was  defined:  for  any  system  other  than  System  1,  a factor  and 
function  pair  (that  is  not  scored  in  System  1)  is  significant  if  its 
average  rating  is  neither  greater  than  4 nor  less  than  2.  (Recall  that 
the  rating  scale  ranges  between  1 and  5.) 
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Figure  6 shows  which  factor  and  function  pairs  are  significant  by 
each  criterion  and  identifies  the  system  in  which  the  pair  first  becomes 
critical.  For  example,  function  3 (determine  flow  plan)  was  found  to  be 
critical  relative  to  factor  2 (recognition)  in  System  4.  The  signifi- 
cance criterion  in  this  case  was  a maximum  rating  change  of  at  least  1. 


B.  Analysis  of  Critical  Factor  and  Function  Pairs 

The  analysis  of  critical  factor  and  function  pairs  identified  in 
Figure  6 addressed  the  operational  implications  of  the  critical  pairs  in 
the  context  of  five  control  processes--8ector  traffic  flow  planning,  air 
craft  flight  path  planning,  separation  assurance  decision  making,  flight 
information  decision  making,  and  control  message  transmission.  These 
operational  interactions  were  examined  to  develop  an  understanding  of 
the  reasons  why  raters  perceived  certain  factors  and  functions  as  crit- 
ical. 


The  control  process  functions  were  grouped  according  to  the  opera- 
tional roles  assigned  to  the  human  controllers.  The  control  functions 
listed  in  Table  5 were  aggregated  into  one  of  three  subprocesses; 

(1)  monitoring;  (2)  taking  action  (or  making  a decision);  and  (3)  as- 
sessing the  results  of  a computer-generated  plan  or  alarm.  The  first 
two  subprocesses  can  be  automated;  the  third  is  a by-product  of  automa- 
tion and  is  found  typically  in  Control -by-Except ion,  Levels  I and  II. 
The  assessment  process  often  replaces  a monitoring  or  action  task  taken 
over  by  automation  and  thus  serves  as  compensation  to  the  controller. 


1 . Sector  Traffic  Flow  Planning  Process 

In  the  sector  traffic  flow  planning  process,  as  it  is  Implemented 
today  (see  Table  5),  a controller  monitors  data  describing  changes  to 
the  sector  equipment  and  weather  status,  procedural  constraints  Imposed 
by  other  sector  or  flow  controllers,  and  the  aggregate  traffic  situation, 
and  then  defines  and  coordinates  a sector  traffic  flow  plan.  Automation 
plays  no  part  in  the  decision-making  process.  The  control  functions  im- 
plemented in  System  1 can  be  broken  down  into  three  control  subprocesses; 
(1)  the  controller  monitors  status  changes  (monitoring);  (2)  determines 
a flow  plan  (decision-action);  and  (3)  Issues  the  flow  plan  (action). 

In  System  3 (Terminal  Decision  Aid  Automation),  the  computer  reviews  the 
sector  operating  status  and  defines  and  displays  a sector  traffic  flow 
plan.  Two  action  functions  have  been  automated  and  taken  away  from  the 
controller,  but  in  return  the  controller  performs  two  assessment  func- 
tions: he  reviews  and  revises  the  computer-recommended  plan.  As  auto- 

mation increases  in  Systems  5 and  6 (Control-by-Exception  Levels  II  and 
III),  these  assessment  functions  are  reduced  and  finally  eliminated  aa 
the  controller  is  no  longer  required  to  monitor  the  computer. 

As  indicated  in  Figure  6,  the  sector  traffic  flow  planning  process 
has  two  critical  functions;  determination  of  the  traffic  flow  plan  (ac- 
tion) and  issuance  of  the  flow  plan  (action).  Beginning  with  System  3, 
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FIGURE  6 CRITICAL  FACTOR  AND  FUNCTION  PAIRS 


;<*• 

I 

there  is  a significant  reduction  in  rating  for  several  job  satisfaction 
and  motivation  factors:  recognition,  responsibility,  skill  utilization, 
challenge,  and  interest.  Although  the  controller  was  given  responsi- 
bility for  two  assessment  functions,  the  raters  felt  that  these  tasks 
did  not  adequately  compensate  for  tasks  that  were  previously  performed 
manually,  as  the  ratings  for  the  functions  were  about  average.  It  can 
[ be  concluded  that  the  performance  of  the  sector  traffic  flow  planning 

process  la  regarded  as  a satisfying  challenge.  Substituting  assessment 
functions  for  this  process  is  not  compensatory  because  the  challenge  has 
been  preempted  by  the  computer. 

The  stress  associated  with  determining  the  sector  traffic  flow  plan 
is  seen  to  be  reduced  as  automated  equipment  takes  over  the  function. 

The  substituted  assessment  function  also  received  a significant  rating 
indicating  low  stress.  The  tasks  of  reviewing  and  revising  the  computer's 
plan  w4re  not  considered  stressful  because  raters  regard  the  computer  as 
competent  to  perform  this  planning  function.  This  observation  is  corrob- 
orated by  the  significant  score  given  to  the  assessment  function  in  de- 
cision making:  raters  regarded  the  review  of  a computer's  flow  plan  as 
relatively  easy  (in  fact,  easier  than  reviewing  a plan  manually) . 


2.  Aircraft  Flight  Path  Planning 

In  the  aircraft  flight  path  planning  process,  either  a controller  or 
automation  monitor  change  aircraft  flight  plans,  tracks,  and  the  traf- 
fic situation  and  define  a flight  path  plan  for  each  aircraft  in  the  sec- 
tor. This  process  is  performed  automatically  in  Systems  3 through  6 
(Terminal  Decision  Aid  Automation  and  all  ciii.3e  levels  of  Control-by- 
Exception) . In  Systems  3 and  4 the  controller  reviews  and  can  revise 
the  computer-recommended  flight  path  plan;  in  System  5 the  controller 
reviews  the  plan  without  critical  assessment;  and  in  System  6 there  is 
no  human  Involvement  in  this  process. 

The  aircraft  flight  path  planning  process  fits  the  subprocess  aggre- 
gation since  it  has  a monitor  function,  decision-action  function,  and  an 
assessment  function  (composed  of  the  review  and  revise  functions) . Be- 
ginning with  System  3.  the  assessment  function  is  substituted  for  the 
monitoring  and  decision-action  functions;  in  System  5,  however,  it  be- 
comes passive  as  the  controller  is  expected  only  to  review  the  computer- 
reconnended  flight  path  plan.  The  assessment  function  is  taken  away 
completely  in  System  6.  The  job  satisfaction  and  motivation  factors  of 
recognition,  responsibility,  skill  utilization,  challenge,  and  interest 
are  all  rated  significantly  low  for  both  the  monitor  ind  decision-action 
functions  (see  Figure  6).  Interestingly  enough,  the  monitor  function  is 
rated  significantly  lower  in  recognition  only  in  System  5,  where  the 
controller  is  expected  to  review  the  computer-recommended  flight  plan  to 
stay  abreast  of  development  but  not  to  critically  assess  it.  The  con- 
troller's interest  does  not  wane  significantly  until  System  6 when  he 
has  no  part  whatever  in  the  flight  path  planning  process. 
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The  amount  of'vlgilance  required  to  monitor  changes  in  the  traffic 
flight  path  plana  is  reduced  significantly  when  that  function  is  auto- 
mated. Similarly,  the  amount  of  stress  involved  in  determining  a flight 
path  plan  for  an  individual  aircraft  is  reduced  when  that  function  is 
automated  in  System  3.  Substituting  assessment  functions  for  the  moni- 
toring and  decision-action  functions  had  no  significant  effect.  The 
raters  Judged  the  assessment  functions  to  be  approximately  average  with 
respect  to  both  job  satisfaction  and  motivation  and  man-machine  inter- 
face factors. 


3.  Separation  Assurance  Decision-Making  Process 

The  separation  assurance  decision-making  process  is  the  most  tactical 
of  the  control  processes  and  includes  some  of  the  most  important  functions 
performed  by  the  controller.  In  the  current  NAS/ARTS  system,  the  control- 
ler monitors  changing  aircraft,  track,  and  traffic  situations;  searches 
for  control  intervention  situations;  identifies  potential  conflicts;  and 
defines  and  coordinates  clearances  and  advisories  to  resolve  conflicts. 

The  controller  also  responds  to  computer  alerts  for  emergency  situations 
(conflict  alert  and  MSAW) . In  System  2 and  all  higher-level  automation 
systems,  a conflict  probe  automatically  identifies  potential  conflicts 
and  recoimends  resolution  actions.  Beginning  with  System  3 the  controller 
is  not  even  required  to  monitor  all  routinely  changing  aircraft  traffic 
situations;  he  is  responsible,  however,  for  reviewing  and  revising  the 
computer's  recommended  resolution  of  a potential  conflict.  This  assess- 
ment function  is  reduced  in  System  5 where  the  controller  is  required  to 
modify  the  computer's  strategy  for  resolving  potential  conflicts  but  not 
to  review  the  details  of  clearance  and  advisory  messages.  By  System  6 
the  controller's  only  role  is  to  monitor  the  computer's  report  of  an  im- 
minent emergency  conflict  situation.  He  has  no  active  role  and  is  re- 
quired neither  to  determine  specific  clearances  and  strategies  nor  to 
revise  a computer's  plans.  The  controller  only  monitors  pilot  traffic 
situation  voice  reports  from  an  occasional  aircraft  that  is  not  equipped 
with  data  link. 

Although  the  separation  assurance  decision-making  process  has  a 
relatively  large  number  of  functions  compared  with  the  other  control 
processes,  it  can  still  be  broken  down  into  monitoring,  decision-action, 
and  assessment  subprocesses.  (*The  functions  making  up  these  subprocesses 
may  not  be  contiguous  in  the  system  descriptions.)  The  monitoring  sub- 
process Involves  maintaining  awareness  of  the  air  traffic  situation  and 
searching  for  potential  conflicts  and  Intervention  action.  The  decision- 
action  subprocess  consists  of  confirming  conflicts  and  determining  spe- 
cific clearances  and  advisories.  The  assessment  subprocess  consists  of 
reviewing  and  revising  a computer's  recommended  clearances  and  advisories 
as  well  as  developing  overall  strategy  for  avoiding  conflict.  The  first 
monitoring  function  in  the  process  (function  11,  where  the  routine  air 
traffic  situation  is  monitored)  is  downrated  for  the  Job  satisfaction 
and  motivation  factors  starting  with  System  3,  the  first  system  in  which 
that  function  is  automated.  This  is  one  of  the  primary  Jobs  of  the  air 
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traffic  controller,  and  Its  loss  Is  felt  In  recognition,  responsibility, 
skill  utilisation,  challenge,  and  interest.  The  raters  indicated,  how- 
ever, that  less  vigilance  would  be  required  once  the  monitoring  of  the 
routine  air  traffic  situation  were  automated,  and  thus  the  level  of  stress 
on  the  controller  would  be  reduced.  Another  monitoring  function  in  this 
separation  assurance  process  (function  15)  is  the  conflict  alert  system 
implemented  to  detect  imminent  conflict  situations.  This  function  is 
considered  to  be  fully  automated  throughout  all  the  systems  under  con- 
sideration, but  is  given  a low  rating  in  terms  of  responsibility,  skill 
utilisation,  and  challenge  only  in  Systems  5 and  6.  This  reduced  rating 
corresponds  to  the  controller's  reduced  participation  in  the  entire  sep- 
aration assurance  process.  The  raters  also  felt  a reduction  in  stress 
beginning  with  System  3,  where  automation  and  integration  of  the  func- 
tions concerned  with  planning  and  conflict  avoidance  become  more  complete. 

The  decision-action  subprocess  is  composed  of  three  functions.  In 
function  17,  the  existence  of  a potential  conflict  is  confirmed;  in  18, 
a strategy  to  resolve  the  potential  conflict  is  developed;  and  in  19, 
specific  clearances  and  advisories  are  determined.  The  automation  of 
these  functions  beginning  in  System  2 causes  an  immediate  and  signifi- 
cant drop  in  the  ratings  of  recognition,  responsibility,  skill  utiliza- 
tion, challenge,  and  interest.  Simultaneously,  a significant  reduction 
in  stress  on  the  controller  is  recognized.  Although  functions  17,  18, 
and  19  are  now  handled  automatically,  function  20  reviewing  the  com- 
puter's assessment  and  recommended  conflict  resolution,  seems  to  com- 
pensate for  their  loss  (see  Figure  6).  The  recognition  factor  is  not 
rated  above  average  for  function  20;  the  reason  for  this  may  be  that, 
although  the  raters  see  the  review  function  as  a challenging  and  inter- 
esting task  that  utilizes  controller  skills  and  requires  a great  amount 
of  responsibility,  the  controller  per  se  will  not  receive  recognition 
for  reviewing  a computer's  assessment  of  a conflict.  The  raters  did  see 
a significant  increase  in  recognition  for  performing  the  revision  func- 
tion. Revision  is  an  active,  creative  process;  review  is  a passive  one. 

Beginning  in  System  2,  the  stress  to  a controller  is  reduced  with 
the  automation  of  the  decision-action  function.  This  is  consistent  with 
the  rater’s  Judgment  of  stress  as  other  monitoring  and  decision-action 
functions  become  automated.  However,  for  this  process,  the  assessment 
functions  are  negatively  compensatory  in  that  the  raters  saw  an  Increase 
in  stress  as  the  controller  revised  the  computer-generated  strategy, 
clearances,  and  advisories.  [iTiis  fact  is  not  indicated  in  Figure  6 be- 
cause the  degree  of  stress  narrowly  missed  the  criterion  used  to  produce 
the  figure  (stress  was  judged  at  2.1  for  System  2;  the  cutoff  value  was 
2.0) .] 


The  separation  assurance  decision-making  process  is  the  only  control 
process  for  which  failure  mode  factors  received  critical  scores.  These 
scores  were  received  in  System  6 for  the  routine  monitoring  function 
(function  11)  and  the  conflict  alert  system  (function  15).  It  can  be 
concluded  that  the  raters  were  most  concerned  with  tactical  control  of 
the  sector  and  felt  that  problems  would  arise  if  the  controller  were  en- 
tirely removed  from  Che  loop. 
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Rater  responses  and  remarks  concerning  failure  mode  factors  Indicate 
that  the  descriptions  of  failure  recovery  operations  were  not  precise 
enough  to  enable  a rater  to  appreciate  fully  failure  consequences.  There- 
fore, critical  failure  mode  factor  scores  could  have  been  received  for 
other  systems  had  failure  operations  been  described  In  more  detail. 


4.  Flight  Information  Decision-Making  Process 

The  flight  Information  declslon-maklng  process  consists  of  Identi- 
fying the  flight  path  clearance  and  Information  needs  of  each  aircraft 
that  have  not  been  satisfied  as  part  of  the  separation  assurance  process. 
In  the  current  NAS/ARTS  system  this  process  Is  performed  manually.  In 
System  3 the  computer  Identifies  and  electronically  displays  advisories 
or  clearances  which  the  controller  reviews  and  accepts  or  revises.  He 
also  prepares  supplemental  advisories  required  by  the  aircraft.  In  Sys- 
tems 4 through  6 the  flight  Information  declslon-maklng  process  Is  per- 
formed automatically  with  no  human  Involvement. 

The  process  can  be  broken  down  Into  three  subprocesses.  The  moni- 
toring and  decision-action  functions  are  performed  more  or  less  simul- 
taneously as  the  controller  or  computer  determines  specific  clearances 
and  advisories  as  the  need  arises.  ITic  assessment  function  consists  of 
the  controller  reviewing  or  revising  the  computer- recommended  flight  in- 
formation and  adding  advisories  as  necessary.  Some  of  the  job  satis- 
faction and  motivation  factors  (recognition,  responsibility,  skill  uti- 
lization, challenge,  interest)  are  rated  significantly  lower  beginning 
In  System  3,  when  the  monitoring  and  decision-action  functions  become  au- 
tomated. The  substitution  of  an  assessment  function  for  these  functions 
does  not  seem  to  compensate  the  controller,  however,  since  the  assess- 
ment function  Is  given  only  an  average  rating.  The  monitoring  and 
decision-action  functions  are  rated  only  slightly  lower  in  Systems  4,  5, 
and  6 (where  there  Is  no  assessment),  which  indicates  that  the  perfor- 
mance of  the  assessment  function  holds  little  significance  for  a con- 
troller. 


5 . Control  Message  Transmission  Process 

The  control  message  transmission  process  in  the  current  NAS/ARTS 
system  consists  of  a controller  Issuing  voice  clearance  and  advisories 
and  updating  paper  and  computer  records.  In  System  4,  the  automatic 
machinery  Issues  clearances  by  data  link  and  electronically  displays 
flight  plan  data  updates.  The  controller  confirms  the  clearance  Issu- 
ance by  the  computer  and  relays  by  voice  the  computer-generated  clear- 
ances for  non-data-llnk  aircraft.  Thus,  beginning  with  System  4,  the 
controller  plays  no  part  In  the  control  message  transmission  process 
other  than  to  Interact  with  non-data-llnk  aircraft.  This  has  an  adverse 
effect  on  the  rater's  judgment  of  recognition,  responsibility,  skill 
utilisation,  challenge,  and  Interest.  Neither  the  substitute  action 
function--relaylng  clearances--nor  the  substitute  function--reviewlng 
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the  computer-delivered  clearances  (System  4 only),  are  rated  higher  than 
average  for  any  Job  satisfaction  and  motivation  factor.  These  functions 
are  therefore  not  seen  as  compensatory  for  manual  delivery  of  clearances 
and  information  to  all  aircraft--a  controller's  sole  interaction  with 
pilots  that  is  rated  high  in  responsibility  and  recognition.  The  descrip- 
tions developed  for  the  Control-by-Exception  systems  (Systems  4,  5,  and 
6)  assume  that  only  occasional  aircraft  would  be  without  data-link  equip- 
ment. Considering  the  relative  Infrequency  of  the  necessity  to  relay 
clearances,  and  the  fact  that  the  controller  is  acting  only  as  a conduit 
for  computer-generated  messages,  it  is  easy  to  understand  the  raters' 
lack  of  enthusiasm  for  the  substitution  functions. 

The  amount  of  vigilance  required  to  perform  the  monitoring  function 
is  reduced  significantly  in  System  3 as  is  the  stress  involved  in  de- 
termining the  specific  clearances  and  advisories.  The  raters  judged 
that  little  stress  was  produced  by  the  assessment  function,  so  there  is 
no  negative  compensation  in  this  case. 
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VI  CONCI.USIONS 


The  results  of  this  first-cut  study  of  the  Impact  of  automation  on 
air  traffic  control  indicate  that  automation  tends  to  reduce  both  the 
human  rewards  and  the  stress  associated  with  A.TC  system  operations. 
However,  this  reduction  can  be  moderated  to  a degree  by  the  introduction 
of  new  control  functions  into  future  ATC  operations. 

In  System  1 (NAS/ARTS),  the  least  automated  of  the  ATC  system  con- 
figurations, the  performance  of  planning  and  tactical  control  functions 
requires  a high  degree  of  Intellectual  involvement.  Controllers  have 
direct  authority  and  responsibility  for  ATC  system  operations  and  are 
held  accountable  for  their  actions.  They  derive  rewards  in  terms  of  job 
satisfaction  and  motivation,  but  they  also  experience  stress.  The  po- 
sition of  authority  and  responsibility  held  by  today's  controller  re- 
quires a commensurate  degree  of  technical  expertise  and  a commensurate 
capability  to  apply  the  expertise.  A controller's  technical  expertise 
results  from  his  extensive  training  in  the  complexities  of  ATC  operations 
and  his  ability  to  mentally  structure  spatial  relationships  and  logically 
assess  the  consequences  of  control  actions.  Today's  controller  must  ag- 
gressively use  highly  specialized  knowledge  to  make  command  decisions  in 
a time-critical  environment,  coordinate  his  decisions  with  other  con- 
trollers, and  issue  his  decisions  to  pilots.  The  controller  Interacts 
with  machines  to  obtain  and  process  information  and  with  other  humans  to 
negotiate  and  carry  out  decision  making. 

In  System  2 (Enroute  Decision  Aid  Automation  with  conflict  probe), 
where  the  controller  is  required  to  review  and  revise  computerized  con- 
flict resolution  recommendations,  little  overall  impact  of  automation  on 
either  job  satisfaction  and  motivation  or  stress  was  perceived,  apparently 
because  highly  developed  skills  are  still  required  to  critically  review 
tactical  control  actions. 

As  planning  and  tactical  control  functions  become  more  automated, 
the  reduction  in  human  planning  and  tactical  control  functions  become 
more  automated,  the  reduction  in  human  rewards  and  stress  becomes  more 
pronounced.  System  3 (Terminal  Decision  Aid  Automation  with  metering 
and  spacing)  and  Systems  A and  5 (Control-by-Exception,  Levels  I and  II, 
with  control  message  automation  and  data  link)  require  controllers  to 
review  computer-generated  plans  and  tactical  control  operations.  The 
automation  of  planning  functions  removes  much  of  the  direct  human  inter- 
actions asKjng  controllers  and  does  not  appear  to  introduce  new  control 
functions  that  significantly  compensate  for  the  loss  of  job  satisfaction 
and  motivation.  However,  automation  of  planning  functions  in  System  3 
was  perceived  to  reduce  stress.  A reduction  in  stress  and  job  satisfac- 
tion due  to  automating  tactical  control  functions  was  evident  in  System  5 
where  controllers  review  conflict  resolution  strategies  rather  than  the 
details  of  clearance  and  advisory  messages.  Although  the  review  functions 
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retained  by  the  controllers  in  Systems  3,  4,  and  5 require  a working 
knowledge  of  A.TC  operations,  controllers  experience  fewer  opportunities 
to  aoply  their  expert  skills. 

In  System  6 (Control -by-Except ion,  I.evel  III)  job  satisfaction  and 
motivation  rewards  and  stress  are  largely  removed.  The  job  of  the  con- 
troller is  relegated  to  inputting  and  processing  miscellaneous  data. 
Controller  skills  required  for  this  system  need  not  be  as  highly  developed 
as  those  of  predecessor  systems.  As  a result,  controllers  would  be  less 
competent  to  handle  failure  situations  and  would  be  much  leas  likely  to 
maintain  awareness  of  the  tactical  sector  situation. 

In  suntnary.  System  2 seems  to  be  the  most  promising  of  the  future 
systems  in  terms  of  comparability  between  operational  design  and  human 
factors.  The  conflict  probe  of  System  2 would  enable  controllers  to  ap- 
ply expert  skills  to  critically  review  computerized  actions  and  there- 
fore would  not  severely  limit  their  ability  to  exercise  highly  trained 
capabilities.  System  6,  where  the  controller  is  almost  completely  "out 
of  the  loop"  but  acts  as  overall  systems  manager,  would  be  acceptable 
given  a radical  change  in  both  the  type  of  person  performing  the  job  and 
the  training  received.  This  of  course  assumes  technological  components 
of  such  quality  and  redundancy  that  a controller  could  be  removed  com- 
pletely from  the  tactical  ATC  situation. 

Because  Systems  3,  A,  and  5 reduce  the  opportunities  of  today's 
controllers  to  apply  their  expert  skills,  inconsistencies  between  human 
expectations  and  rewards,  would  result.  For  these  systems,  highly 
trained  control  skills  equivalent  to  those  of  today's  controllers  would 
be  necessary  if  the  controller  is  expected  to  perform  recovery  operations 
in  the  event  of  automation  failure.  Underutilization  of  these  expert 
skills,  caused  by  removing  the  planning  functions  from  the  job  respon- 
sibilities of  controllers,  appears  to  account  in  large  part  for  reduc- 
tions in  job  satisfaction  and  motivation  rewards.  Such  underutilization 
of  expert  skills  could  also  undermine  the  capabilities  of  controllers  to 
respond  to  failures,  regardless  of  their  training. 
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SYSTEM  1:  NAS /ARTS 


Operational  Overview 

Technological  Components 

The  current  enroute  NAS  Stage  A and  terminal  ARTS  III  ATC  operations 
Include  alr/ground  (A/G)  and  Interphone  voice  communications;  automated 
flight  data  processing/ forwarding ; air  traffic  control  radar  beacon  sys- 
tem (ATCRBS) ; automatic  tracking  displays  with  alphanumerlcs  (Including 
Mode  C and  reported  altitudes  and  ground  speed);  automatic  and  manual 
display  filters;  surveillance  data  mosalclng  (enroute  only);  simplified 
clearance/coordination  procedures;  conflict  alert;  minimum  safe  altitude 
warning  (MSAW) ; and  central  flow  control. 


Sector  Control  Operation 

The  NAS/ARTS  computer  operation  processes,  forwards,  and  presents 
aircraft  situation  and  flight  plan  data  and  control  system  data.  The 
enroute  and  terminal  sector  controller (s)  performs  the  declslon-maklng 
requirements  of  each  control  process.  He  determines  sector  traffic  flow 
plans  (In  coordination  with  other  sector  and  flow  controllers);  defines 
flight  path  plans  for  aircraft  under  his  Jurisdiction;  formulates  strat- 
egies, clearance,  and  advisories  for  separation  assurance  and  flight 
Information  requirements;  and  Issues  all  control  messages  using  A/G  voice 
communications.  These  control  activities  may  be  preempted  by  conflict 
alerts  or  MSAWs,  which  the  controller  reviews  and  resolves  by  A/G  voice. 

To  obtain  and  exchange  data  needed  to  carry  out  his  responsibilities, 
the  controller  systematically  scans  a PVD  traffic  situation  presentation, 
conducts  A/G  voice  comnunlcatlons  with  pilots,  coordinates  with  other 
controllers  by  means  of  Interphone  voice  communications,  reads  computer- 
processed  messages  on  a computer  readout  device  (CRD),  manually  arranges 
and  updates  (by  handwriting)  paper  flight  strips,  and  manually  Inputs 
computer  Information  by  means  of  trackball  and  keyboard  data  processing 
devices. 


Control  Process  Roles 

The  control  process  roles  for  the  NAS/ARTS  system  are  given  in 

Table  A-1. 
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Table  A-1 


SYSTEM  1:  NAS /ARTS  CONTROL  PROCESS  ROLES 


Control  Process 

Role 

Sector  traffic 
flow  planning 

M: 

The  hunian(s)  monitors  data  describing  changes  to 
the  sector  equipment  and  weather  status,  proce- 
dural constraints  Imposed  by  other  sector  or  flow 
controllers,  and  the  aggregate  traffic  situation 
and  defines  and  coordinates  a sector  traffic  flow 
plan. 

A: 

The  computer(s)  processes  routine  flight  plan  and 
sector  operating  situation  data  with  paper  and 
electronic  displays. 

Aircraft  flight 
path  planning 

M; 

The  hunien(s)  monitors  changing  aircraft  flight 
plan,  track,  and  traffic  situations  and  defines 
and  finalizes  a flight  path  plan  for  each  sector 
aircraft . 

A; 

Ttie  computer(s)  processes  routine  flight  plan, 
track  and  sector  traffic  situation  data  with 
paper  and  electronic  displays. 

Separation 
asauraoce 
decision  making 

M; 

The  human(s)  monitors  changing  aircraft  track  and 
traffic  situations,  searches  for  control  inter- 
vention situations,  identifies  potential  con- 
flicts, and  defines  and  coordinates  clearances 
and  advisories  to  resolve  the  conflicts.  The 
human  also  responds  to  computer  alerts  for  emer- 
gency situations. 

A: 

The  computer(s)  processes  routine  flight  plan, 
track,  and  sector  operating  situation  data  with 
paper  and  electronic  displays,  and  searches  for 
and  alerts  the  controller  of  inminent  conflicts. 

Flight  infor- 
metlon  decision 
making 

M: 

The  humanCs)  identifies  the  aircraft  flight  in- 
formation needs  that  have  not  been  satisfied  as 
part  of  the  separation  assurance  process  and 
defines  data  service  clearances  and  advisories. 

A: 

The  computcr(s)  processes  flight  plan,  track,  and 
sector  operating  situation  data  with  paper  and 
electronic  displays  . 

Control 

message 

M: 

The  humane s)  issues  by  voice  Che  clearance  and 
advisories  and  updates  paper  and  computer  records- 

transmission 

A: 

1 

The  computer(s)  forwards  flight  plan  data  updates 
with  paper  and  electronic  displays. 

M « man;  A « automation. 
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Control  Function  Summary 


Sector  Traffic  Flow  Planning  Process 

1.  Monitor  changes  to  the  sector  operating  3tatu8--M 

The  enroute  or  terminal  controller  updates  his  mental  picture 
of  the  sector's  status  with  respect  to  weather,  ATC  equipment, 
and  procedural  rule  changes  by  receiving  voice,  paper-printed, 
or  electronically  displayed  messages. 

3.  Determine  a sector  traffic  flow  plan--M 

The  controller  devises  the  sector  traffic  flow  plan  he  intends 
to  implement.  He  defines  the  preferred  routes  and  procedural 
altitude,  speed,  and  spacing  restrictions  within  the  sector 
and  at  sector  entry  points  that  will  complement  the  sector's 
operating  status  and  observed  traffic. 

6.  Issue  the  sector  traffic  flow  plan--M 

The  controller  coordinates  his  traffic  flow  plan  with  that  of 
other  controllers  through  interphone  communication. 


Aircraft  Flight  Path  Planning  Process 

7.  Monitor  changes  to  the  traffic  flight  plan8--M 

The  controller  receives  flight  plan  updates  for  aircraft  not 
yet  in  his  sector,  scans  the  PVD  for  aircraft  approaching  his 
sector,  and  accepts  hand-offs  on  aircraft  entering  the  sector. 

8.  Determine  a flight  path  plan  for  an  aircraft--M 

The  controller  reviews  the  filed  flight  plan  of  an  aircraft 
and  checks  its  compatibility  with  the  current  traffic  situation, 
accepts  the  plan  as  filed  or  modifies  it  as  necessary,  and 
updates  paper  and  computer  data  records. 


Separation  Assurance  Decision-Making  Process 

11.  Monitor  the  routinely  changing  air  traffic  situation--M 

The  controller  receives  A/G  voice  reports  and  pilot  requests 
and  systematically  scans  the  PVD  in  general  for  aircraft  situa- 
tion data. 
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1 

I 14.  Search  for  a potential  control  intervention  action — M 

The  controller  looks  for  indications  of  developing  potential 
conflict  situations  by  reviewing  the  flight  path  plans  and 
situation  data  In  order  to  recognize  Intersecting  or  coinci- 
dental flight  paths. 


15.  Search  for  an  undetected  inmlnent  (emergency)  conflict 
sltuatlon--A 


This  function  is  the  automated  conflict  alert/MSAW  operation 
and  is  performed  in  parallel  with  controller  monitoring  and 
searching. 

★ 

16.  Monitor  a computer  report  of  an  imminent  (emergency)  conflict 
sltuatlon--M 

If  an  emergency  is  flagged  (including  graphical  and  message 
display)  by  the  conflict  alert  or  MSAW,  the  controller  deter- 
mines the  specific  clearances  and  advisories  needed  to  resolve 
the  conflict  situation. 

r 

17.  Confirm  existence  or  nonexistence  of  a potential  conflict--M 

The  controller  reviews  information  pertinent  to  a potential 
conflict  including  aircraft  type,  visibility,  and  metering  and 
spacing  procedures.  He  selects  appropriate  separation  rules, 
compares  projected  trajectory  closure  against  those  rules,  and 
determines  whether  or  not  potential  violations  of  separation 
exist. 

18.  Determine  a strategy  to  resolve  the  potential  conflict--M 

The  controller  selects  a strategy  to  resolve  a confirmed  poten- 
tial conflict  that  is  compatible  with  sector  procedures  and  the 
traffic  congestion  environment.  These  include  procedural 
separation  (assignment  of  nonintersecting  routes  or  altitudes) 
or  tactical  separation  (vectors  or  speed  controls). 

19.  Determine  specific  clearances  and  advisories  to  resolve  the 
potential  conflict--M 

The  controller  calculates  precise  flight  trajectory  adjustments, 
determines  specific  clearances  for  potentially  conflicting 


Pertains  to  conflict  alert  and  MSAW  interruptions  to  routine  control 
activities . 
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aircraft,  aad  coordinates  these  clearances  with  other  control- 
lers If  necessary. 


Flight  Information  Decision  Making  Process 

23.  Search  for  a flight  information  service  action  (other  than 
separation  services) --M 

The  controller  examines  the  projected  flight  path  of  an  aircraft 
and  reviews  information  that  may  be  needed  in  order  to  ensure 
the  aircraft's  progress  (if  such  information  has  not  been 
determined  as  part  of  the  separation  assurance  process). 

24.  Determine  specific  clearances  and  advisories  to  provide  flight 
information  service--M 


The  controller  identifies  precise  flight  information  data  re- 
quirements such  as  the  need  for  route  or  altitude  clearance, 
vectoring,  weather  information,  or  frequency  change  assignment. 


Control  Message  Transmission  Process 
28.  Issue  clearances  and  advisories--M 


The  controller  transmits  voice  messages  to  the  aircraft,  re- 
ceives responses  and  acknowledgments,  and  updates  paper  and 
computer  records. 
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Appendix  B 


SYSTEM  2:  ENRDUTE  DECISION  AID  AUTCMATION 


Operational  Over\^lew 

TechnoloRical  Components 

We  envision  the  technological  structure  o£  this  system  to  be  com- 
posed of  the  following  representative  hardware/software  capabilities: 

• Current  technology,  including  A/G  and  interphone  voice  communica- 
tions, ATC  radar  beacon  system  (ATCRBS),  flight  data  processing 
(FDP),  conflict  alert,  and  minimum  safe  altitude  warning  (MSAW). 

• Information  aids,  including  automated  data  handling  (ADH)  with 
tabular  displays  and  touch-entry  data  processing,  and  area 
navigation  (RNAV). 

• Decision  aids,  including  conflict  probe,  enroute  metering,  auto- 
mated local  flow  control,  automated  central  flow  control. 

Sector  Control  Operations 

The  enroute  decision  aid  automation  performs  decision-making  require- 
ments for  the  separation  assurance  process  but  is  managed  by  and  subject 
to  intervention  by  a controller  (who  issues  all  control  messages  using 
A/G  voice  communications).  The  computerized  decision  making  is  directed 
by  conflict  probe  automation  and  is  supplemented  by  flow  control/metering 
automation;  the  latter  specifies  external  procedural  constraints  to  the 
controller's  sector  traffic  flow  planning. 

The  enroute  sector  controller (s)  performs  the  sector  traffic  flow 
and  aircraft  flight  path  planning  and  manually  enters  planning  and  flight 
data  not  otherwise  available  to  the  computer.  The  conflict  probe  searches 
for  and  assesses  potential  conflict  situations.  The  controller  reviews 
and  accepts  or  revises  computer-recommended  clearances  and  advisories  to 
resolve  potential  conflicts;  he  also  determines  (without  computer  assis- 
tance) flight  information  clearances  and  advisories.  These  actions 
enablt'.  the  controller  to  direct  the  conflict  probe  actions,  integrate 
this  automation  service  into  his  decision-making  process,  and  formulate 
control  messages  for  A/G  voice  transmission.  These  control  activities 
may  be  preempted  by  computer-generated  resolutions  for  conflict  alerts 
or  HSAWs  which  the  controller  issues  by  A/G  voice. 


To  obtain  and  exchange  data  needed  to  carry  out  his  responsibilities, 
the  controller  systematically  scans  a PVD  traffic  situation  presentation, 
conducts  A/G  voice  communications  with  pilots,  reads  computer-generated 
messages  on  an  electronic  tabular  display,  coordinates  with  other  con- 
trollers using  the  tabular  display  with  qulck-actlon  touch-entry  data 
procaaalng  or  by  Interphone  voice  communications,  and  manually  processes 
computer  data  using  the  touch-entry  device. 


Control  Process  Roles 


The  control  process  roles  for  the  enroute  decision  aid  automation 
system  are  given  In  Table  B-1. 


Control  Function  Sumnary 

Sector  Traffic  Flow  Planning  Process 

1-  Monitor  changes  to  the  sector  operating  status — M 

The  enroute  controller  updates  his  mental  picture  of  the 
sector's  status  with  respect  to  weather,  ATC  equipment,  and 
procedural  rule  changes  by  receiving  voice  or  electronically 
displayed  messages. 

3.  Determine  a sector  traffic  flow  plan--M 

The  controller  devises  the  sector  traffic  flow  plan  he  Intends 
to  Implement.  He  defines  the  preferred  routes  and  procedural 
altitude,  speed,  and  spacing  restrictions  within  the  sector 
and  at  sector  entry  points  that  will  complement  the  sector's 
operating  status  and  observed  traffic. 

6.  Issue  the  sector  traffic  flow  plan — M 

The  controller  coordinates  his  traffic  flow  plan  with  that  of 
other  controllers  through  Interphone  communication. 


Aircraft  Flight  Path  Planning  Process 

7.  Monitor  changes  to  the  traffic  flow  plans — M 

The  controller  receives  flight  plan  updates  for  aircraft  not 
yet  In  his  sector,  scans  the  PVD  for  aircraft  approaching  his 
sector,  and  accepts  hand-offs  on  aircraft  entering  the  sector. 

8.  Determine  a flight  path  plan  for  an  alrcraft--M 

The  controller  reviews  the  filed  flight  plan  of  ar  aircraft 
and  checks  Its  compatibility  with  the  current  traffic  situation, 
accepts  the  plan  as  filed  or  modifies  It  as  necessary,  and 
updates  computer  data  records. 


Table  B-1 


SYSTBM  2:  ENRDUTE  DECISION  AID  AUTOMATION 
CONTROL  PROCESS  ROLES 


Control  Process 

1 Role* 

Sector  traffic 
flow  planning 

M: 

The  hunan(s)  monitors  data  describing  changes  to 
the  sector  equipment  and  weather  status,  proce- 
dural constraints  Imposed  by  the  flow  control 
automation,  and  Che  aggregate  traffic  situation 
and  defines  and  coordinates  a sector  traffic  flow 
plan. 

A; 

The  computer(s)  processes  and  electronically  dis- 
plays routine  flight  plan.  Crack,  and  sector  oper- 
ating situation  data  (enhanced  by  flow  control 
automation) . 

Aircraft 
flight  path 
planning 

M: 

The  human(s)  monitors  changing  aircraft  flight 
plan,  track,  and  traffic  situations  and  defines 
and  finalizes  a flight  path  plan  for  each  sector 
aircraft. 

A: 

The  computerfs)  processes  and  electronically  dis- 
plays routine  flight  plan,  track,  and  sector  oper- 
ating situation  data. 

Separation 
ass Mrance 
decision  making 

M: 

The  human(s)  monitors  changing  aircraft  track  and 
traffic  situations,  searches  for  control  Inter- 
vention situations,  calls  for  and  Instructs  auto- 
mated conflict  probe  situation  assessments,  and 
reviews,  accepts  or  revises,  and  coordinates 
computer-recommended  conflict  resolution  clear- 
ances and  advisories.  The  human  also  responds  to 
computer  alerts  for  emergency  situations. 

A: 

The  computer  performs  conflict  probe  actions  as 
Instructed  by  the  controller  (l.e.,  automatically 
Identifies  potential  conflicts  and  recommends 
resolution  actions),  automatically  performs  con- 
flic  alert  operations,  and  processes  and  electron- 
ically displays  routine  flight  plan,  track,  and 
sector  operating  situation  data. 

Flight 

Information 
decision  making 

M: 

The  hunanfs)  Identifies  the  flight  Information 
needs  of  aircraft  that  have  not  been  satisfied  as 
part  of  the  separation  assurance  process  and 
defines  the  data  service  clearances  and 
advisories. 

A:  The-  computer(s)  processei  and  electronically  dis- 
plays routine  flight  plan,  track,  and  sector  oper- 
ating situation  data. 


Control 

message 

transmission 


M: 


A: 


Ttje  human(a)  Issues  by  voice  the  clearance  and 
advisories  and  updates  computer  records. 

The  computer(s)  forwards  and  electronically  dis- 
plays flight  plan  data  updates. 


* 


M 


sMn;  A 


automation. 
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Separation  Assurance  Dectalon-MakinR  Process 

11.  Monitor  the  routinely  chanRlng  air  traffic  3ltuatton--M 

The  controller  receives  A/G  voice  reports  and  pilot  requests 
and  systematically  scans  the  PVD  In  general  for  aircraft  situa- 
tion data. 

13.  Establish  automated  processing  of  control  Intervention  actions — M 

The  enroute  controller  Inputs  Information  not  otherwise  avail- 
able to  the  computer,  such  as  pilot  voice  reports  and  requests 
and  the  status  and  Identity  of  aircraft  on  the  A/G  frequency. 

Such  actions  Initiate  and  update  the  automated  conflict  probe 
and  enable  the  controller  to  call  for  specific  conflict  searches 
(especially  when  aircraft  first  call  In  on  frequency). 


15.  Search  for  an  undetected  Imminent  (emergency)  conflict 
sltuatlon--A 

This  function  Is  the  automated  conflict  alert/MSAW  operation 
and  Is  performed  In  parallel  with  controller  monitoring. 

16. *  Monitor  a computer  report  of  an  Imminent  (emergency)  conflict 

sltuatlon--M 

If  an  emergency  Is  flagged  (Including  graph'.cal  message  display) 
by  the  conflict  alert  or  MSAW,  the  controller  determines  the 
specific  clearances  and  advisories  needed  to  resolve  the  con- 
flict situation. 


17.  Confirm  existence  or  nonexistence  of  a potential  confllct--A 

18.  Determine  a strategy  to  resolve  the  potential  confllct--A 

19.  Determine  specific  clearances  and  advisories  to  resolve 
the  potential  confllct--A 

The  computerized  conflict  probe  searches  for  and  confirms  a 
potential  conflict  situation,  defines  an  appropriate  strategy 
to  resolve  the  conflict,  and  defines  specific  clearances  and 
advisories  to  Implement  the  resolution  strategy. 


Pertains  to  conflict  alert  and  MSAW  Interruptions  to  routine  control 
activities. 
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20.  Review  the  computer  assessment  and  recommended  resolution  of 
a potential  confllct--M 

The  controller  receives  a graphical  display  of  a potential  con- 
flict situation  as  well  as  electronically  displayed  messages 
Including  the  quantitative  data  regarding  the  situation  and 
recomnended  clearances  and  advisories.  The  controller  Identifies 
the  recommended  resolution  strategy,  compares  the  projected 
trajectories  against  the  appropriate  separation  rules  and  the 
sector  procedural  plan,  and  accepts  or  rejects  the  computer 
recommendations. 

21 . Revise  the  computer-recommended  strategy,  clearances, 
and  advisories  to  resolve  the  potential  conflict--M 

If  the  controller  rejects  the  computer- recommended  actions,  he 
mentally  revises  the  strategy,  calculates  precise  flight  tra- 
jectory adjustments,  defines  clearances  and  advisories,  and 
coordinates  the  clearances  with  other  controllers  as  necessary. 


Flight  Information  Decision-Making  Process 

23.  Search  for  a flight  information  service  action  (other  than 
separation  services) --M 

The  controller  examines  the  projected  flight  path  of  an  air- 
craft and  reviews  information  that  may  be  needed  in  order  to 
ensure  the  aircraft's  progress  (if  such  information  has  not 
been  determined  as  part  of  the  separation  assurance  process). 

24 . Determine  specific  clearances  and  advisories  to  provide 
flight  information  servlce--M 

The  controller  identifies  precise  flight  information  data  re- 
quirements such  as  the  need  for  route  or  altitude  clearances, 
vectoring,  weather  information,  or  frequency  change  assignment. 


Control  Message  Transmission  Process 
28.  Issue  clearances  and  advi8ories--M 


The  controller  transmits  voice  messages  to  the  aircraft,  re- 
ceives responses  and  acknowledgments,  and  vipdates  computer 
records. 
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Appendix  C 

SYSTEM  3:  TERMINAL  DECISION  AID  AUTOMATION 


Operational  Overview 

Technological  Components 

We  envision  the  technological  structure  of  this  system  to  be  composed 
of  the  following  representative  hardware /software  capabilities: 

• Current  technology,  including  A/G  and  interphone  voice  communica- 
tions, ATC  radar  beacon  system  (ATCRBS),  flight  data  processing 
(FDP),  conflict  alert,  and  minimum  safe  altitude  warning  (MSAW) . 

• Information  aids,  including  automated  data  handling  (ADH)  with 
tabular  displays  and  touch-entry  data  processing,  wind  shear 
advisory,  microwave  landing  system  (MLS),  area  navigation  (RNAV), 
and  airport  surface  traffic  control  (ASTC). 

• Decision  aids,  including  refined  metering  and  spacing,  automated 
wake  vortex  avoidance  system  (WVAS),  and  central  flow  control. 


Sector  Control  Operation 

The  terminal  decision  aid  automation  performs  the  decision-making 
requirements  for  the  sector  traffic  flow  and  aircraft  flight  path  plan- 
ning processes,  the  separation  assurance  control  message  definition  pro- 
cess, and  the  basic  aspects  of  flight  information  message  Identification. 
These  functions  are  managed  by  and  subject  to  intervention  by  the  con- 
troller, who  issues  all  control  messages  using  A/G  voice  communications. 
The  computerized  operation  is  directed  by  metering  and  spacing  automated 
in  coordination  with  flow  control  and  metering  automation. 

The  terminal  sector  controller (s)  reviews  and  accepts  or  revises 
the  computer-recommended  sector  traffic  flow  plans,  aircraft  flight  path 
plans,  and  specific  clearances  and  advisories  to  resolve  potential  con- 
flicts and  satisfy  essential  flight  information  needs.  The  controller 
determines  supplementary  flight  information  messages  (in  addition  to  the 
basic  requirements  recommended  by  the  controller)  and  manually  enters 
sector  status  data  and  flight  information  (including  voice  message  data) 
not  otherwise  available  to  the  computer.  These  actions  enable  the  con- 
troller to  maintain  cognizance  of  and  exercise  directive  authority  over 
the  control  automation  so  that  he  may  mentally  assimilate  computer- 
generated  plans  and  control  messages  and  issue  A/G  voice  clearances  and 
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advisories.  These  control  activities  may  be  preempted  by  computer- 
generated resolutions  for  conflict  alerts  or  MSAWs,  which  the  controller 
issues  by  A/G  voice. 

To  obtain  and  exchange  data  needed  to  carry  out  his  responsibilities, 
the  controller  reads  computer-generated  messages  on  an  electronic  tabular 
display,  selectively  scans  a PVD  traffic  situation  presentation,  conducts 
A/G  voice  communications  with  pilots,  coordinates  with  other  controllers 
using  the  tabular  display  with  quick-action  tough-entry  data  processing 
or  by  Interphone  voice  communications,  and  manually  processes  con^juter 
data  using  the  touch-entry  device. 


Control  Process  Roles 

The  control  process  roles  for  the  terminal  decision  and  automation 
system  are  given  in  Table  C-1. 


Control  Function  Summary 

Sector  Traffic  Flow  Planning  Process 

1.  Monitor  changes  to  the  sector  operating  status — M. 

The  terminal  controller  updates  his  mental  picture  of  the 
sector's  status  with  respect  to  weather,  ATC  equipment,  and 
procedural  rule  changes  by  receiving  voice  or  electronically 
displayed  messages. 

2.  Establish  the  automated  processing  of  a sector  traffic  flow 
plan--M 

The  controller  Inputs  data  not  otherwise  available  to  the  com- 
puter describing  revisions  to  the  sector's  equipment  status, 
weather  status,  and  procedural  constraints.  This  data  entry 
instructs  the  computer  to  devise  a sector  traffic  flow  plan. 

3.  Determine  a sector  traffic  flow  plan--A 

The  computerized  flow  control  and  metering  and  spacing  operation 
automatically  defines  a sector  traffic  flow  plan  including 
preferential  routes,  altitudes,  speeds,  and  spacing  restrictions. 

4.  Review  the  computer-recommended  sector  traffic  flow  plan--M 

The  controller  receives  the  electronically  displayed  computer- 
recomnended  sector  traffic  flow  plan.  He  compares  this  plan 
with  the  sector  operating  status  and  the  aggregate  traffic 
congestion  situation  as  presented  on  a PVD  and  accepts  or 
rejects  the  computer's  recommendation. 
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Table  C-1 


SYSTEM  3:  TERMINAL  DECISION  AID  AUTOMATION 


CONTROL  PROCESS  ROLES 

Control  Process 

Role 

Sector  traffic 
flow  planning 

M: 

*^e  hijman(s)  monitors  data  (some  of  which  is  not 
available  to  the  computer)  describing  changes  to 
the  sector  equipment  and  weather  status  and  pro- 
cedural constraints  imposed  by  flow  control  auto- 
mation, updates  computer  records,  and  reviews, 
accepts  or  revises,  and  coordinates  the  computer- 
recommended  sector  traffic  flow  plan. 

A; 

The  computer(s)  reviews  the  sector  operating  sta- 
tus (as  updated  by  the  controller),  procedural 
constraints  Imposed  by  the  flow  control  automa- 
tion, and  the  aggregate  traffic  situation  and 
defines  and  electronically  displays  a sector 
traffic  flow  plan. 

Aircraft  flight 
path  planning 

M; 

The  human(8)  receives  and  accepts  or  revises  the 
computer-recommended  flight  path  plan  for  each 
aircraft. 

A; 

The  computer(s)  monitors  aircraft  flight  plan, 
track,  and  traffic  situations  and  defines  and 
electronically  displays  a flight  path  plan  for 
each  sector  aircraft. 

The  human(8)  monitors  flight  data  not  available 
to  the  computer  (l.e.,  pilot  voice  reports  and 
requests),  updates  computer  records,  reviews 
computer  assessments  of  potential  conflict  situa- 
tions, and  accepts  or  revises  and  coordinates 
the  computer-recommended  conflict  resolution 
clearances  and  advisories.  The  human  also  re- 
sponds to  computer  alerts  for  emergency  situa- 
tions . 

The  computer(s)  monitors  the  changing  aircraft 
track  and  traffic  situations  (Including  the  con- 
troller updates),  searches  for  control  interven- 
tion situations.  Identifies  potential  conflicts, 
and  defines  and  electronically  displays  clear- 
ances and  advisories  to  resolve  the  conflicts. 


The  hunan(s)  reviews  and  accepts  or  revises  basic 
flight  Information  clearances  recommended  by  the 
computer  and  determines  supplemental  advisories 
required  by  Che  aircraft. 

The  computer(s)  Identifies  and  electronically 
displays  the  flight  path  clearance  Information 
(exclusive  of  general  flight  circumstances  data) 
needs  of  each  aircraft  that  have  not  been  satis- 
fied as  part  of  the  separation  assurance  process. 

M:  The  human(s)  issues  by  voice  the  clearance  and 
advisories  and  updates  computer  records. 

A;  The  cnmputer(s)  forwards  and  electronically  dis- 
plays flight  plan  data  updates. 


M m oian;  A • automation. 


Control 

message 

transmission 


Flight 
Information 
decision  making 


M: 


A: 


Separation 
assurance 
decision  making 
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5. 


Revise  the  computer- recommeaded  sector  traffic  flow  plaa--M 


If  the  controller  rejects  the  computer's  plan,  he  defines  an 
alternative  sector  traffic  flow  plan  and  inputs  its  parameters 
to  the  computer. 

6.  Issue  the  sector  traffic  flow  plan--A 

The  computer  automatically  communicates  the  features  of  the 
sector  traffic  flow  plan  to  other  controllers. 


Aircraft  Flight  Path  Planning  Process 

7.  Monitor  changes  to  traffic  flight  plans--A 

8.  Determine  a flight  path  plan  for  an  aircraft--A 

The  computerized  metering  and  spacing  operation  tracks  aircraft 
trajectories,  reviews  filed  flight  plans,  checks  flight  plan 
compatibility  with  the  sector  traffic  flow  plan  and  current 
traffic  situation,  and  accepts  a flight  plan  as  filed  or 
modifies  it  as  necessary. 

9.  Review  the  computer -recommended  flight  path  plan-~M 

The  controller  reviews  the  electronically  displayed  computer- 
recommended  flight  path  plan  in  order  to  remain  aware  of  the 
ATC  situation,  to  check  on  the  plan's  validity  relative  to  the 
sector  traffic  flow  plan,  and  to  accept  or  reject  the  computer's 
recommendation. 

10.  Revise  the  computer-recommended  flight  path  plan--M 

If  the  recommended  flight  path  plan  is  rejected,  the  controller 
selects  procedural  restrictions  that  correct  the  deficiencies 
in  the  computer-recommended  plan  and  inputs  new  parameters  to 
the  computer. 


Separation  Assurance  Decision-Making  Process 

11.  Monitor  the  routinely  changing  aircraft  3ituation--A 

The  computerized  metering  and  spacing  operation  automatically 
tracks  the  movement  of  air  traffic  through  the  sector's  airspace. 

12.  Monitor  only  routinely  changing  air  traffic  situations  reported 
by  pilot9--M 

The  controller  receives  A/G  pilot  voice  reports  and  requests 
and  selectively  scans  the  PVD  for  specific  aircraft  situation 
data. 


13.  Establish  automated  processing  of  control  Intervention  actlons--M 


The  terminal  controller  Inputs  Information  not  otherwise  avail- 
able to  the  computer,  such  as  pilot  voice  reports  and  requests 
and  the  status  and  Identity  of  aircraft  on  the  A/G  frequency. 

Such  actions  update  the  automated  metering  and  spacing  operation. 


15.  Search  for  an  undetected  Imminent  (emergency)  conflict 
sltuatlon--A 

This  function  is  the  automated  conflict  alert/MSAW  operation 
and  is  performed  in  parallel  with  automated  metering  and  spacing 
and  controller  monitoring. 

★ 

16.  Monitor  a computer  report  of  an  imninent  (emergency)  conflict 
8ltuatlQn--M 

If  an  emergency  is  flagged  (including  graphical  and  message 
display)  by  the  conflict  alert  or  MSAW,  the  controller  deter- 
mines the  specific  clearances  and  advisories  needed  to  resolve 
the  conflict  situation. 


17.  Confirm  existence  or  nonexistence  of  a potential  conflict--A 

18.  Determine  a strategy  to  resolve  the  potential  conflict--A 

19.  Determine  specific  clearances  and  advisories  to  resolve  the 
potential  confllct--A 

The  computerized  metering  and  spacing  operation  searches  for 
and  confirms  a potential  conflict  situation,  defines  an  appro- 
priate strategy  to  resolve  the  conflict,  and  defines  specific 
clearances  and  advisories  to  implement  the  resolution  strategy. 

20.  Review  the  computer  assessment  and  recommended  resolution  of 
a potential  conflict--M 

The  controller  receives  a graphical  display  of  a potential  con- 
flict situation  as  well  as  electronically  displayed  messages  in- 
cluding quantitative  data  regarding  the  situation  and  recommended 
clearances  and  advisories.  The  controller  Identifies  the  recom- 
mended resolution  strategy,  compares  the  projected  trajectories 
with  the  appropriate  separation  rules  and  the  sector  procedural 
plan,  and  accepts  or  rejects  the  computer's  recommendations. 


★ 

Pertain  to  conflict  alert  and  MSAW  interruptions  to  routine  control 
activities. 
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• , 21.  Revise  the  computer-recommended  strategy,  clearances,  and 

I advisories  to  resolve  the  potential  confltct--M 

If  the  controller  rejects  the  computer-recomnended  actions,  he 
mentally  revises  the  recommended  strategy,  calculates  precise 
flight  trajectory  adjustments,  defines  clearances  and  advisories, 
and  coordinates  the  clearances  with  other  controllers  as 
necessary. 


Flight  Information  Decision-Making  Process 

23.  Search  for  a flight  information  service  action--A 

24.  Determine  specific  clearances  and  advisories  to  provide  flight 
information  servlces--A 

The  computerized  metering  and  spacing  operation  identifies 
essential  clearances  and  advisories  required  by  the  aircraft 
to  proceed  along  their  flight  paths  (if  such  Information  has 
not  been  determined  as  part  of  the  separation  assurance  process). 

25.  Review  computer-reconmended  action  for  flight  Information 
service--M 

I 

I 

The  controller  reviews  the  electronically  displayed  clearances 
by  the  computer  In  order  to  remain  aware  of  the  ATC  situation, 
to  check  on  the  clearances'  validity  relative  to  the  flight 
plan  and  the  sector  procedural  plan,  and  to  accept- or  reject 
the  computer's  reconmendation. 

26.  Determine  advisories  to  supplement  the  computer-reconmended 
clearances--M 

If  the  controller  accepts  the  computer-recommended  clearances, 
he  reviews  the  advisory  issuance  history  of  an  aircraft,  com- 
pares it  with  its  flight  plan  and  flight  data  needs,  and  iden- 
tifies additional  advisory  information  if  necessary. 

27.  Revise  computer-recommended  flight  information  service  action--M 

If  the  controller  rejects  the  computer-recommended  flight  infor- 
mation clearances,  he  formulates  corrected  clearances  and  sup- 
plemental advisories. 


Control  Message  Transmission  Process 

28.  Issue  clearances  and  advisorie8--M 


The  controller  transmits  voice  messages  to  the  aircraft,  re- 
ceives responses  and  acknowledgments,  and  updates  computer 
records. 
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13. 


Establish  automated  processing  of  control  Intervention  acttons--M 


The  terminal  controller  Inputs  Information  not  otherwise  avail- 
able to  the  computer,  such  as  pilot  voice  reports  and  requests 
and  the  status  and  identity  of  aircraft  on  the  A/G  frequency. 

Such  actions  update  the  automated  metering  and  spacing  operation. 


15.  Search  for  an  undetected  imminent  (emergency)  conflict 
aituatlon--A 

This  function  is  the  automated  conflict  alert/MSAW  operation 
and  is  performed  in  parallel  with  automated  metering  and  spacing 
and  controller  monitoring. 

★ 

16.  Monitor  a computer  report  of  an  imminent  (emergency)  conflict 
8ituatlon--M 

If  an  emergency  is  flagged  (Including  graphical  and  message 
display)  by  the  conflict  alert  or  MSAW,  the  controller  deter- 
mines the  specific  clearances  and  advisories  needed  to  resolve 
the  conflict  situation. 

i 

I 

17 . Confirm  existence  or  nonexistence  of  a potential  conflict--A 

18.  Determine  a strategy  to  resolve  the  potential  conflict — A 

19.  Determine  specific  clearances  and  advisories  to  resolve  the 
potential  confllct--A 

The  computerized  metering  and  spacing  operation  searches  for 
and  confirms  a potential  conflict  situation,  defines  an  appro- 
priate strategy  to  resolve  the  conflict,  and  defines  specific 
clearances  and  advisories  to  implement  the  resolution  strategy. 

20.  Review  the  computer  assessment  and  recommended  resolution  of 
a potential  conflict — M 

The  controller  receives  a graphical  display  of  a potential  con- 
flict situation  as  well  as  electronically  displayed  messages  in- 
cluding quantitative  data  regarding  the  situation  and  recommended 
clearances  and  advisories.  The  controller  identifies  the  recom- 
mended resolution  strategy,  compares  the  projected  trajectories 
with  the  appropriate  separation  rules  and  the  sector  procedural 
. plan,  and  accepts  or  rejects  the  computer's  recommendations. 


it 

Pertain  to  conflict  alert  and  MSAW  interruptions  to  routine  control 
activities. 
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Appendix  D 


SYSTEM  4:  CONTROL-BY-EXCEPTION  (LEVEL  I) 


Operational  Overview 

Technological  Components 

We  envision  the  technological  structure  of  this  system  to  be  composed 
of  the  following  representative  hardware/ software  capability: 

• Current  technology,  Including  A/G  and  Interphone  voice  communica- 
tions, conflict  alert,  and  minimum  safe  altitude  warning  (MSAW). 

• Information  aids,  including  automated  data  handling  (ADH)  with 
tabular  display  and  touch-entry  data  processing,  microwave  landing 
system  (MLS),  area  navigation  (RNAV),  and  airport  surface  traffic 
control  (ASTC). 

• Decision  aids,  including  enroute  metering,  automated  local  flow 
control,  automated  central  flow  control,  and  automated  wake 
vortex  avoidance  system  (WVAS). 

• Decision  automation,  including  control  message  automation  (CMA) , 
data  link,  automatic  traffic  advisory  and  resolution  service 
(ATARS),  and  discrete  address  beacon  system  (DABS). 


Sector  Control  Operation 

The  enroute  and  terminal  controlrby-exceptlon  Level  I operation  auto- 
matically performs  the  decision-making  requirements  of  each  control  pro- 
cess and  conducts  data  link  communications  with  aircraft  but  is  subject 
to  human  intervention  in  regard  to  Its  sector  traffic  flow  and  aircraft 
flight  path  planning  and  separation  assurance  detailed  message  formula- 
tion functions.  The  flight  information  decision  process  is  not  subject 
to  hianan  intervention.  The  computerized  operation  Is  directed  by  control 
message  automation  in  coordination  with  flow  control/metering  automation. 

The  enroute  and  terminal  sector  controller (s)  reviews  and  accepts  or 
revises  the  computer-recommended  sector  traffic  flow  plans,  aircraft 
flight  path  plansi  and  specific  clearances  and  advisories  to  resolve 
potential  conflicts.  He  also  manually  enters  some  sector  status  and 
flight  data  not  otherwise  available  to  the  computer.  These  actions 
enable  the  controller  to  maintain  cognizance  of  and  exercise  direction 
over  the  details  of  the  separation  assurance  activities.  He  does  not 
critically  assess  or  routinely  concern  himself  with  computer-generated 
flight  information  clearances  and  advisories;  the  computerized  operation 
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Is  assumed  to  be  capable  of  generating  valid  flight  Information  messages. 
Clearances  and  advisories  are  Issued  by  data  link,  except  for  those  few 
messages  requiring  voice  relay  by  the  controller  (e.g. , communications 
with  Infrequent  non-data-llnk  aircraft).  These  control  activities  may 
be  preempted  by  ATARS /conflict  alerts  or  MSAWs,  which  are  monitored  by 
the  controller. 

To  obtain  and  exchange  data  needed  to  carry  out  his  responsibilities, 
the  controller  retds  computer-generated  messages  on  an  electronic  tabular 
display,  visually  studies  selected  traffic  situations  on  a PVD-llke  graph- 
ical presentation,  and  manually  Inputs  data  to  the  computer  using  a qulck- 
actlon,  touch-entry  device.  If  necessary,  he  coordinates  with  other 
controllers  using  the  tabular  display  with  touch-entry  data  processing 
or  by  Interphone  voice  communications  and  conducts  some  A/G  voice  cotnnu- 
nlcatlons  with  pilots. 


Control  Process  Roles 


The  control  process  roles  for  the  control-by-exceptlon  (Level  I) 
system  are  given  in  Table  D-1. 


Control  Function  Summary 

Sector  Traffic  Flow  Planning  Process 

1 . Monitor  changes  to  the  sector  operating  3tatus--M 

The  enroute  or  terminal  controller  updates  his  mental  picture 
of  the  sector's  status  with  respect  to  weather,  ATC  equipment, 
and  procedural  rule  changes  by  receiving  voice  or  electronically 
displayed  messages. 

2 Establish  the  automated  processing  of  a sector  traffic  flow 
plan--M 

The  controller  Inputs  data  not  otherwise  available  to  the  com- 
puter describing  revisions  to  the  sector's  equipment  status, 
weather  status,  and  procedural  constraints.  This  data  entry 
Instructs  the  computer  to  devise  a sector  traffic  flow  plan. 

3.  Determine  a sector  traffic  flow  plan--A 

The  computerized  flow  control  and  control  message  automation 
defines  a sector  traffic  flow  plan  Including  preferential 
routes,  altitudes,  speeds,  and  spacing  restrictions. 


70 


Table  D-I 


SYSTEM  4:  CONTROL-BY -EXCEPTION  (LEVEL  1) 
CONTROL  PROCESS  ROLES 


Control  Proceat 

Role* 

Sector  traffic 
flow  planning 

M: 

The  human(8)  monitors  data  (some  of  which  la  not 
available  to  the  computer)  describing  changes  to 
the  sector  equipment  and  weather  status  and  pro- 
cedural constraints  Imposed  by  flow  control  auto- 
mation, updates  computer  records,  and  reviews, 
accepts  or  revises,  and  coordinates  the  computer- 
reccmaended  sector  traffic  flow  plan. 

A: 

The  computer(s)  reviews  the  sector  operstlng 
status  (as  updated  by  the  controller),  procedural 
constraints  Imposed  by  the  flow  control  automa- 
tion, and  the  aggregate  traffic  situation  and 
defines  and  electronically  displays  a sector  traf- 
fic flow  plan. 

Aircraft  flight 
path  planning 

M; 

The  huraan(s)  reviews  and  accepts  or  revises  the 
computer-recommended  flight  path  plan  for  each 
sector  aircraft. 

A: 

The  computer(s)  monitors  aircraft  flight  path 
plan,  track,  and  traffic  situations  and  defines 
and  electronically  displays  a flight  path  plan 
for  each  sector  aircraft. 

Separation 
aaaurance 
daclalon  making 

M: 

The  human(s)  monitors  flight  data  not  available 
to  the  computer  (l.e.,  pilot  voice  reports  and 
requests  from  non-data-llnk  aircraft),  updates 
computer  records,  reviews  computer  assessments  of 
potential  conflict  situation,  and  accepts  or 
revises  and  coordinates  computer-recommended  con- 
flict resolution  clearances  and  advisories.  The 
human  also  monitors  computer  alerts  for  emergency 
situations. 

A: 

The  computer(s)  monitors  the  changing  aircraft 
track  and  traffic  situations  (Including  the  con- 
troller updates),  searches  for  control  Interven- 
tion situations.  Identifies  potential  conflicts, 
and  defines  and  electronically  displays  clear- 
ances and  advisories  to  resolve  the  conflicts. 

Flight 

H: 

No  hiinan  Involvement. 

Information 
daclalon  making 

A: 

The  cofl>puter(s)  Identifies  the  flight  path  clear- 
ance and  advisory  Information  needs  of  each  air- 
craft that  have  not  been  satisfied  as  part  of  the 
separation  assurance  process. 

Control  meaaage 
tranamlaa Ion 

M; 

The  human(s)  confirms  the  Issuance  by  the  com- 
puter of  potential  conflict  resolution  clear- 
ances and  advisories  and  relays  by  voice  (with- 
out further  critical  assessment)  computer- 
delayed  clearances  and  advisories  for  non-data- 
llnk  aircraft. 

A: 

The  computer(s)  Issues  clearances  and  advisories 
by  data  link  and  forwards  and  electronically  dis- 
plays flight  plan  data  updatea. 

• Mn;  A ■ autcxutlon. 
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4. 


Review  the  computer-recommended  sector  traffic  flow  plan — M 


The  controller  receives  the  electronically  displayed  computer- 
recomnended  sector  traffic  flow  plan.  He  compares  this  plan 
with  the  sector  operating  status  and  the  aggregate  traffic 
situation  as  presented  on  a PVD  and  accepts  or  rejects  the 
computer's  recomnendatlon. 

5.  Revise  the  computer- recomnended  sector  traffic  flow  plan--M 

If  the  controller  rejects  the  computer's  plan,  he  defines  an 
alternative  sector  traffic  flow  plan  and  inputs  Its  parameters 
to  the  computer. 

6.  Issue  the  sector  traffic  flow  plan--A 

The  computer  automatically  coimiunlcates  the  features  of  the 
sector  traffic  flow  plan  to  other  controllers. 


Aircraft  Flight  Path  Planning  Process 

7.  Monitor  changes  to  traffic  flight  plans--A 

8.  Determine  a flight  path  plan  for  an  aircraft — A 

The  computerized  control  message  automation  tracks  aircraft 
trajectories,  reviews  filed  flight  plans,  checks  flight  plan 
compatibility  with  the  sector  traffic  flow  plan  and  current 
traffic  situation,  and  accepts  the  flight  plan  as  filed  or 
modifies  It  as  necessary. 

9.  Review  the  computer-recommended  flight  path  plan--M 

The  controller  reviews  the  electronically  displayed  computer- 
recommended  flight  path  plan  in  order  to  remain  aware  of  the 
ATC  situation,  to  check  on  the  plan's  validity  relative  to  the 
sector  traffic  flow  plan,  and  to  accept  or  reject  the  computer's 
recommendation. 

10.  Revise  the  computer-recommended  flight  path  plan--M 

If  the  recommended  flight  path  plan  Is  rejected,  the  controller 
selects  procedural  restrictions  that  correct  the  deficiencies 
in  the  computer's  recommendation  and  Inputs  new  paran.jters  to 
the  computer. 
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Separation  Assurance  Dectsion-MaklnR  Process 


11.  Monitor  the  routinely  changlnR  aircraft  8ltuatlon--A 

The  computerized  control  message  automation  tracks  the  movement 
of  air  traffic  through  the  sector's  airspace. 

12.  Monitor  only  routinely  changing  air  traffic  situations  reported 
by  pilota--M 

The  controller  receives  initial  call-ins  from  all  aircraft  coming 
onto  the  A/G  voice  frequency  and  maintains  communications  with 
the  occasional  non-data-link  aircraft. 

13.  Establish  automated  processing  of  control  intervention  actions — M 

The  enroute  or  terminal  controller  Inputs  information  not  other- 
wise available  to  the  computer,  such  as  the  status  and  identity 
of  aircraft  on  the  A/G  frequency.  He  also  Inputs  information 
to  the  computer  concerning  the  requests  of  those  few  non-data- 
link  aircraft. 


15.  Search  for  an  undetected  imminent  (emergency)  conflict 
situation- -A 

This  function  is  the  automated  conflict  alert/ATARS/MSAW  oper- 
ation and  is  performed  in  parallel  with  control  message  auto- 
mation and  controller  monitoring. 

★ 

16.  Monitor  a computer  report  of  an  imminent  (emergency)  conflict 
situation--M 

If  an  emergency  is  flagged  (including  graphical  and  message 
display)  by  the  conflict  alert/ATARS/MSAW,  the  controller 
maintains  awareness  of  the  situation  being  processed  by  the 
automated  operation. 


17.  Confirm  existence  or  nonexistence  of  a potential  conflict--A 

18.  Determine  a strategy  to  resolve  the  potential  conflict--A 


★ 

Pertains  to  conflict  alert,  ATARS,  and  MSAW  interruptions  to  routine 
control  activities. 
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19.  Determine  specific  clearancea  and  advisories  to  resolve 
the  potential  confllct--A 

The  computerized  control  message  automation  searches  for  and 
confirms  a potential  conflict  situation,  defines  an  appropriate 
strategy  to  resolve  the  conflict,  and  defines  specific  clear- 
ances and  advisories  to  Implement  the  resolution  strategy. 

20.  Review  the  computer  assessment  and  recommended  resolution  of 
a potential  confllct--M 

The  controller  receives  a graphical  display  of  a potential 
conflict  situation  as  well  as  electronically  displayed  messages 
Including  quantitative  data  regarding  the  situation  and  recom- 
mended clearances  and  advisories.  The  controller  identifies 
the  reconmended  resolution  strategy,  compares  the  projected 
trajectories  with  the  appropriate  separation  rules  dnd  the 
sector  procedural  plan,  and  accepts  or  rejects  the  computer's 
recommendations. 

2 1 . Revise  t' le  computer-recommended  strategy,  clearances, 
and  advijories  to  resolve  the  potential  conflict--M 

If  the  controller  rejects  the  computer-recommended  actions,  he 
mentally  revises  the  recommended  strategy,  calculates  precise 
flight  trajectory  adjustments,  defines  clearances  and  advi- 
sories, and  updates  computer  records. 

Flight  Information  Decision-Making  Process 

23.  Search  for  a flight  Information  service  actlon--A 

24.  Determine  specific  clearances  and  advisories  to  provide  flight 
Information  8ervlce--A 

The  computerized  control  message  automation  identifies  all 
specific  clearances  and  advisories  required  by  the  aircraft 
to  proceed  along  their  flight  paths  (if  such  Information  has 
not  been  determined  as  part  of  the  separation  assurance  process). 

« 

Control  Message  Transmission  Process 
28.  Issue  clearances  and  advlsorles--A 


The  computer  automatically  transmits  digitized  control  Instruc- 
tions to  data-link-equlpped  aircraft. 
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29.  Ravlew  computer-transacted  clearances  and  advt3orles--M 

The  controller  monitors  electronically  displayed  reports  of 
the  status  of  data-llnk-transmitted  messages  that  he  has  re- 
viewed as  part  of  the  separation  assurance  process. 

30.  Relay  clearances  and  advl8orle8--M 

The  controller  receives  electronically  displayed  message  instruc- 
tions, coniBunicates  by  voice  with  pilots  of  an  occasional  non- 
data-link  aircraft  or  retransmits  messages  that  could  not  be 
completed  successfully  by  data  link,  and  updates  computer 
records. 
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Appendix  E 

CONTROL-BY-EXCEPTION  (LEVEL  II) 


Appendix  E 


SYSTEM  5:  CONTROL-BY-EXCEPTION  (LEVEL  II) 


Operational  Overview 

Technological  Components 

We  envision  the  technological  structure  of  this  system  to  be  com- 
posed of  the  following  representative  hardware /software  capability: 

• Current  technology,  Including  A/G  and  interphone  voice  communica- 
tions, conflict  alert,  and  minimum  safe  altitude  warning  (MSAW) . 

• Information  aids,  including  automated  data  handling  (ADH)  with 
tabular  display  and  touch-entry  data  processing,  microwave 
landing  system  (MLS),  area  navigation  (RNAV),  and  airport  surface 
traffic  control  (ASTC). 

• Decision  aids,  including  enroute  metering,  automated  local  flow 
control,  automated  central  flow  control,  and  automated  wake 
vortex  avoidance  system  (WVAS). 

• Decision  automation,  including  control  message  automation  (CMA) , 
data  link,  automatic  traffic  advisory  and  resolution  service 
(ATARS),  and  discrete  address  beacon  system  (DABS). 


Sector  Control  Operation 

The  enroute  and  terminal  control-by-exception  Level  II  operation 
automatically  performs  the  decision-making  requirements  of  each  control 
process  and  conducts  data  link  communications  with  aircraft.  It  is 
subject  to  human  intervention  only  in  regard  to  its  separation  assurance 
strategies.  The  computerized  operation  is  directed  by  control  message 
automation  in  coordination  with  flow  control/metering  automation. 

The  enroute  and  terminal  sector  controller (s)  reviews  without  crit- 
ical assessment  and  accepts  the  computer-recommended  sector  traffic  flow 
and  aircraft  flight  path  plans  and  thereby  maintains  cognizance  of  the 
planning  operations  without  directing  them  (although  he  does  manually 
enter  some  sector  status  and  flight  data  not  otherwise  available  to  the 
computer).  The  controller  reviews  and  accepts  or  revises  computer- 
recomnended  strategies  to  resolve  potential  conflicts  and  thereby  main- 
tains cognizance  of  and  exercises  direction  over  the  computerized  separa- 
tion assurance  process.  He  does  not  critically  assess  or  routinely 
concern  himself  with  the  specific  separation  assurance  or  flight  infor- 
mation clearances  and  advisories  generated  by  the  computer;  the  computerized 
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operation  is  assumed  to  be  suitably  refined  to  generate  valid  clearances 
and  advisories.  The  clearances  and  advisories  are  issued  by  data  link, 
except  for  those  few  messages  requiring  voice  relay  by  the  controller 
(e.g. , communications  with  infrequent  non-data-link  aircraft).  These 
control  activities  may  be  preempted  by  ATARS/conf lict  alerts  or  MSAWs, 
which  are  monitored  by  the  controller. 

To  obtain  and  exchange  data  needed  to  carry  out  his  responsibilities, 
the  controller  reads  computer-generated  messages  on  an  electronic  tabular 
display,  visually  studies  selected  traffic  situations  on  a PVD-like  graph- 
ical presentation,  and  manually  inputs  data  to  the  computer  using  a 
quick-action,  touch-entry  device.  If  necessary,  he  coordinates  with  other 
controllers  using  the  tabular  display  with  touch-entry  data  processing 
or  by  interphone  voice  communication  and  conducts  some  A/G  voice  commu- 
nications with  pilots. 


Control  Process  Roles 


The  control  process  roles  for  the  control-by-exception  (Level  II) 
system  are  given  in  Table  E-1. 


Control  Function  Summary 

Sector  Traffic  Flow  Planning  Process 

1.  Monitor  changes  to  the  sector  operating  status--M 

The  enroute  or  terminal  controller  updates  his  mental  picture 
of  the  sector's  status  with  respect  to  weather,  ATC  equipment, 
and  procedural  rule  changes  by  receiving  voice  or  electronically 
displayed  messages. 

2.  Establish  the  automated  processing  of  a sector  traffic  flow 
pl3n--M 

The  controller  inputs  data  not  otherwise  available  to  the  com- 
puter describing  revisions  to  the  sector's  equipment  status, 
weather  status,  and  procedural  constraints.  This  data  entry 
instructs  the  computer  to  devise  a sector  traffic  flow  plan. 

3.  Determine  a sector  traffic  flow  plan--A 

The  computerized  flow  control  and  control  message  automation 
defines  a sector  traffic  flow  plan  including  preferential 
routes,  altitude,  speeds,  and  spacing  restrictions. 
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Table  E-1 


SYSTEM  5:  CONTRDL-BY -EXCEPTION  (LEVEL  II) 


CONTROL  PROCESS  ROLES 

Control  Procosa 

Role 

Sector  trafllc 
flow  plannlt.g 

M;  The  human(s)  monitors  data  (some  of  which  la  not 
available  to  the  computer)  describing  Che  changes 
to  the  sector  equipment  and  weather  status  and 
procedural  constraints  Imposed  by  flow  control 
automation,  updates  computer  records,  and  reviews 
(without  critical  assessment)  and  accepts  the 
computer-recommended  sector  traffic  flow  plan. 

A;  The  computer(s)  reviews  the  sector  operating 

status  (as  updated  by  the  controller),  procedural 
constraints  imposed  by  flow  control  automation, 
and  the  aggregate  traffic  situation  and  defines 
and  electronically  displays  a sector  traffic  flow 
plan. 

AlrcrA^c  flight 
path  planning 

M;  The  human(3)  reviews  (without  critical  assessment) 
and  accepts  the  computer-recommended  flight  path 
plan  for  each  sector  aircraft. 

A:  The  computer(s)  monitors  aircraft  flight  plan, 
track,  and  traffic  situations  and  defines  and 
electronically  displays  a flight  path  plan  for 
each  sector  aircraft. 

Separation 
aaaurance 
declalon  making 

M:  The  human(s)  monitors  flight  data  not  available 
to  the  computer  (l.e.,  pilot  voice  reports  and 
requests  from  non-data-llrk  aircraft),  updates 
computer  records,  reviews  computer  assessments  of 
potential  conflict  situations,  and  accepts  or 
revises  and  coordinates  computer-recommended  con- 
flict resolution  strategies  (without  critically 
reviewing  specific  clearances  and  advisories). 

The  human  also  monitors  computer  alerts  for  emer- 
gency situations. 

A:  The  computer(s)  monitors  the  changing  aircraft 
track  and  traffic  situations  (Including  the  con- 
troller updates),  searches  for  control  Interven- 
tion situations.  Identifies  potential  conflicts, 
defines  conflict  resolution  clearances  and  advi- 
sories, and  electronically  displays  the  corres- 
ponding conflict  resolution  strategy. 

Plight 

M:  No  human  Involvement. 

Information 
declalon  ataklng 

A:  The  cumputur(s)  Identifies  the  flight  path  clear- 
ance and  advisory  Information  needs  of  each  air- 
craft char  have  not  been  satisfied  as  part  of  the 
separation  assurance  process. 

Control 

meaaage 

tranamlaalon 

M:  The  humanls)  relays  by  voice  (without  further 
critical  assessment)  coraputer-dlaplayed  clear- 
ances and  advisories  for  non-data-llnk  aircraft. 

A:  The  computer(s)  Issues  clearances  and  advisories 
by  data  link  and  forwards  and  electronically  dis- 
plays flight  plan  data  updates. 

H • tMn;  A • automation. 
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Review  the  computer-recommended  sector  traffic  flow  plan--M 


The  controller  receives  and  reviews  the  electronically  displayed 
computer-reconmended  sector  traffic  flow  plan  in  order  to 
remain  aware  of  the  ATC  environment. 

6.  Issue  the  sector  traffic  flow  plan--A 

The  computer  automatically  communicates  the  features  of  the 
sector  traffic  flow  plan  to  other  controllers. 


Aircraft  Flight  Path  Planning  Process 

Monitor  changes  to  traffic  flight  plans--A 

8.  Determine  a flight  path  plan  for  an  aircraft — A 

The  computerized  control  message  automation  tracks  aircraft 
trajectories,  reviews  filed  flight  plans,  checks  flight  plan 
compatibility  with  the  sector  traffic  flow  plan  and  current 
traffic  situation,  and  accepts  the  flight  plan  as  filed  or 
modifies  it  as  necessary, 

9.  Review  the  computer-recommended  flight  path  plan--M 

The  controller  reviews  the  electronically  displayed  computer- 
recommended  flight  path  plan  in  order  to  remain  aware  of  the 
ATC  situation. 


Separation  Assurance  Decision-Making  Process 

11.  Monitor  the  routinely  changing  aircraft  situation--A 

The  computer  automatically  tracks  the  movement  of  air  traffic 
through  the  sector's  airspace. 

12.  Monitor  only  routinely  changing  air  traffic  situations  reported 
by  pilot8--M 

The  controller  receives  initial  call-ins  from  all  aircraft 
coming  onto  the  A/G  voice  frequency  and  maintains  communications 
with  the  occasional  non-data-llnk  aircraft. 

13.  Establish  automated  processing  of  control  intervention  actions — M 

The  enroute  or  terminal  controller  inputs  information  not  other- 
wise available  to  the  computer,  such  as  the  status  and  identity 
of  aircraft  on  the  A/G  frequency.  He  also  inputs  information 
to  the  computer  concerning  the  requests  of  those  few  non-data- 
llnk  aircraft. 
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15.  Search  for  an  undetected  inimlnent  (emerRency)  conflict 
sttuatlon--A 


This  function  Is  the  automated  conflict  alert/ATARS/MSAW  oper- 
ation and  Is  performed  In  parallel  with  control  message  auto- 
mation and  controller  monitoring. 

16.  Monitor  a computer  report  of  an  Imminent  (emergency)  conflict 
sltuatlon--M 

If  an  emergency  Is  flagged  (Including  graphical  and  message 
display)  by  the  conflict  alert/ATARS/MSAW,  the  controller  main- 
tains awareness  of  the  situation  being  processed  by  the  auto- 
mated operation. 

17.  Confirm  existence  or  nonexistence  of  a potential  confllct--A 

18.  Determine  a strategy  to  resolve  the  potential  confllct--A 

19.  Determine  specific  clearance  and  advisories  to  resolve  the 
potential  confllct--A 

The  computerized  control  message  automation  searches  for  and 
confirms  a potential  conflict  situation,  defines  an  appropriate 
strategy  to  resolve  the  conflict,  and  defines  specific  clear- 
ances and  advisories  to  implement  the  resolution  strategy. 

20.  Review  the  computer  assessment  and  recommended  resolution 
of  a potential  confllct--M 

The  controller  receives  a graphical  display  of  a potential 
conflict  situation  as  well  as  electronically  displayed  messages 
Including  quantitative  data  regarding  the  situation  and  recom- 
mended resolution  strategy.  The  controller  compares  the  recom- 
mended resolution  strategy  with  the  sector  procedural  plan  and 
traffic  congestion  situation  and  accepts  or  rejects  the 
computer's  recommendation. 

22.  Revise  only  the  computer-recommended  strategy  to  resolve  the 
potential  confllct-M 

If  the  controller  rejects  the  computer-recommended  plan,  he 
defines  an  alternative  strategy  that  is  compatible  with  the 
sector  traffic  flow  plan  and  traffic  congestion  situation.  He 
enters  the  revised  conflict  resolution  strategy  into  the  com- 
puter by  specifying  the  quantitative  parameters  of  the  tactical 
or  procedural  control  technique  that  he  favors.  The  automated 
operation  determines  the  specific  clearances  and  advisories 
required. 


Pertains  to  conflict  alert,  ATARS,  and  MSAW  interruptions  to  routine 
control  activities. 


83 


Flight  Information  Declston-Maklng  Process 


23.  Search  for  a flight  information  service  action — A 

24.  Determioe  specific  clearances  and  advisories  to  provide  flight 
information  aervice--A 


The  computerized  control  message  automation  identifies  all 
specific  clearances  and  advisories  required  by  the  aircraft 
to  proceed  along  their  flight  paths  (if  such  information  has 
not  been  determined  as  part  of  the  separation  assurance  process). 


Control  Message  Transmission  Process 

28.  Issue  clearances  and  advisories — A 

The  computer  automatically  transmits  digitized  control  instruc- 
tions to  data-link-equipped  aircraft. 

30.  Relay  clearances  and  advtsorie8--M 

The  controller  receives  electronically  displayed  message  instruc- 
tions, communicates  by  voice  with  pilots  on  occasional  non- 
data-link  aircraft  or  retransmits  messages  that  could  not  be 
completed  successfully  by  data  link,  and  updates  computer 
records. 
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Appendix  F 

SYSTEM  6:  C(»JTROL-BY-EXCEPTICN  (LEVEL  III) 
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Appendix  F 

SYSrm  6;  CONTROL-BY-DCCEPTION  (LEVEL  HI) 


Opcretlopel  Overview 

Techooloulcal  Components 

We  envision  Che  technological  structure  of  this  system  to  be  com- 
posed of  Che  following  representative  hardware/sof Cware  capability: 

• Current  technology,  including  A/G  and  Interphone  voice  communica- 
tions, conflict  alert,  and  minimum  safe  altitude  warning  (MSAW) . 

• Information  aids,  including  automated  data  handling  (ADH)  with 
tabular  display  and  Couch-entry  data  processing,  microwave  land- 
ing system  (MLS),  area  navigation  (RNAV) , end  airport  surface 
traffic  control  (ASTC) . 

• Decision  aids.  Including  enrouCe  metering,  automated  local  flow 
control,  automated  central  flow  control,  and  automated  wake 
vortex  avoidance  system  (WVAS) . 

• Decision  automation.  Including  control  message  automation  (CMA) , 
data  link,  automatic  traffic  advisory  and  resolution  service 
(ATAKS) , and  discrete  address  beacon  system  (DABS). 


Sector  Control  Operations 

Tha  enroute  and  terminal  control-by-excepcion  Level  III  operation 
automatically  performs  the  decision-making  requirements  of  each  control 
process  and  conducts  data  link  communications  with  aircraft.  It  Is  not 
subject  to  human  Intervention.  The  computerized  opcrcftim  Is  directed 
by  control  massage  automation  in  coordination  with  flow  control/metering 
autoautlon. 

The  enroute  and  terminal  sector  controller (s)  Is  removed  from  all 
critical  assessment  requirements  but  manually  enters  some  sector  status 
and  flight  data  not  otherwise  available  to  the  computer.  The  computerized 
operation  la  assumed  to  be  suitably  reliable  to  generate  valid  sector 
traffic  flow,  aircraft  flight  path  plans,  and  separation  assurance  aud 
flight  Information  clearances  and  advisories.  The  clearances  and  ad- 
visories are  Issued  by  data  link,  except  for  those  few  messages  requiring 
voice  relay  by  the  controller  (e.g. , comaninlcatlons  with  Infrequent  non- 
data-llnk  aircraft).  These  control  activities  may  be  preempted  by  ATARS/ 
conflict  alerta  or  MSAWs  which  are  monitored  by  the  controller. 
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To  obtain  and  exchange  data  needed  to  carry  out  his  responaibllitlea, 
the  controller  conducts  some  A/G  comnunlcatlons  with  pilots  and  ouinually 
Inputs  data  to  the  computer  using  a qulck-actlon,  touch-entry  device. 

If  necessary,  he  may  monitor  selected  (e.g. , emergency)  traffic  situations 
on  a FVI>>llke  graphical  presentation,  read  computer-generated  messages  on 
an  electronic  tabular  display,  and  coordinate  with  other  controllers 
using  Che  tabular  display  with  touch-entry  data  processing  or  by  voice 
Interphone  cammun:lcaClons. 


Control  Process  Holes 

The  control  process  roles  for  the  control-by-exceptlon  (Level  III) 
system  are  given  In  Table  F-1. 


Control  Function  Sunmary 

Sector  Traffic  Flow  Planning  Process 

1.  Monitor  changes  to  the  sector  operating  status — M 

The  enroute  or  terminal  controller  receives  some  raw  data  (l.e., 
noncomputerized)  describing  changes  to  the  sector's  status 
with  respect  to  weather  and  ATF  equipment  by  receiving  voice 
messages. 

2.  Establish  the  automated  processing  of  a sector  traffic  flow 
plan — M 

The  controller  Inputs  data  not  otherwise  available  to  the  com- 
puter describing  revisions  to  the  sector's  equipment  status 
and  weather  status.  This  data  entry  Instructs  the  computer  to 
devise  s sector  traffic  flow  ''Ian. 

3.  Determine  a sector  traffic  flow  plan — A 

The  computerized  flow  control  and  control  message  automation 
defines  a sector  traffic  flow  plan  Including  preferential  routes, 
altitudes,  speeds,  and  spacing  restrictions. 

6.  lasue  the  sector  traffic  flow  plan“-A 

The  computer  automatically  comoiunlcates  the  features  of  the 
sector  traffic  flow  plan  to  other  controllers. 
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Table  F-l 


SYSTEM  6;  CONTROL-BY-EXCEPTION  (LEVEL  III) 
CONTROL  PROCESS  ROLES 


Control  ProcasB 

Role* 

Sector  traffic 
flow  pVannlng 

M: 

The  huinan(&)  monitors  some  data  not  available  to  the  computer 
describing  the  changes  to  the  sector  equipment  and  weather 
status  and  updates  computer  records.  The  human  does  not 
review  the  computer-recommended  sector  traffic  plan. 

A: 

The  computer (s)  reviews  the  sector  operating  status  (as  up- 
dated by  the  controller),  procedural  constraints  Imposed  by 
flow  control  automation,  and  the  aggregate  traffic  situation 
and  defines  the  sector  ^^rafflc  flow  plan. 

Aircraft  flight 

M: 

No  human  involvement. 

path  planning 

A: 

The  computer(s)  monitors  aircraft  flight  plan,  track,  and 
traffic  situations  and  defines  a flight  path  plan  for  each 
sector  aircraft. 

Separation 
asaurance 
daclalon  making 

M: 

The  human(s)  monitors  flight  data  not  available  to  the  com- 
puter (i.e,,  pilot  voice  reports  and  request  from  non-data- 
Itnk  aircraft)  and  updates  computer  records  (without  criti- 
cally reviewing  computer- recommended  potential  conflict 
actions).  The  controller  also  monitors  computer  alerts  for 
emergency  situations. 

A: 

The  compucer(s)  monitors  the  changing  aircraft  track  and 
traffic  situations  (including  controller  updates),  searches 
for  control  Intervention  situations,  identifies  potential 
conflicts,  and  defines  conflict  resolution  clearances  and 
advisories. 

Plight  Information 

M: 

No  human  Involvement. 

declalon  making 

A: 

The  computer(8)  Identifies  the  flight  path  clearance  and  In- 
formation needs  of  each  aircraft  that  have  not  been  satisfied 
as  part  of  the  separation  assurance  process. 

Control  maaaage 

I crananlaalon 

M: 

The  hunian(8)  relays  by  voice  (without  critical  assessment) 
computer-displayed  clearances  and  advisories  for  non-data- 
llnk  aircraft. 

1 

A: 

The  computerfs)  issues  clearances  and  advisories  by  data  link 
and  forwards  flight  plan  data  updates. 

M - oiani  A ~ automation. 
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Aircraft  Flight  Path  Planning  Process 

7.  Monitor  changes  to  traffic  flight  plans — A 

8,  Determine  a flight  path  plan  for  an  aircraft — A 

The  computerized  control  message  automation  tracks  aircraft 
trajectories,  reviews  filed  flight  plans,  checks  flight  plan 
compatibility  with  the  sector  traffic  flow  plan  and  current 
traffic  situation,  and  accepts  the  flight  plan  as  filed  or 
modifies  it  as  necessary. 


Separation  Assurance  Decision-Making  Process 

11.  Monitor  the  routinely  changing  aircraft  situation--A 

The  computer  automatically  tracks  the  movement  of  air  traffic 
through  the  sector's  airspace. 

12.  Monitor  only  routinely  changing  air  traffic  situations  reported 
by  pilots — M 

The  controller  receives  Initial  call-ins  from  all  aircraft 
coming  into  the  A/G  voice  frequency  and  maintains  communications 
with  occasional  non-data-llnk  aircraft. 

13.  Establish  automated  processing  of  control  intervention  action3--M 

The  enroute  or  terminal  controller  Inputs  information  not  other- 
wise available  to  the  computer,  such  as  the  status  and  identity 
of  aircraft  in  the  A/G  frequency.  He  also  Inputs  information 
to  the  computer  concerning  the  requests  of  those  few  non-data- 
llnk  aircraft. 


[ 15.*  Search  for  an  undetected  imminent  (emergency)  conflict  situa-  { 

1 tion--A  ! 

I I 

I I 

I This  function  is  the  automated  conflict  alert/ATARS/MSAW  opera-  [ 

I tlon  and  is  performed  in  parallel  with  control  message  autonu-  | 

I tion  and  control  monitoring.  ' 1 

I I 

J 16.*  Monitor  a computer  report  of  an  imminent  (emergency)  conflict  | 

I 8ituation--M  I 

I ~ I 

I I 

I If  an  emergency  is  flagged  (including  graphical  and  message  | 

I display)  by  the  conflict  alert/ATARS/MSAW,  the  controller  | 

I maintains  awareness  of  the  situation  being  processed  by  the  | 

I automated  operation.  | 

I » 

it 

Pertain  to  conflict  alert,  ATARS,  ani  MSAW  interruptions  to  routine  con- 
trol  activities. 
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17.  Confirm  existence  or  nonexistence  of  a potential  conflict — A 

18.  Deteimlne  a strategy  to  resolve  the  potential  conflict — A 

19.  Determine  specific  clearances  and  advisories  to  resolve  the 
potentlel  confllct~-A 

The  computerized  control  message  automation  searches  for  and 
confirms  a potential  conflict  situation,  defines  an  appropriate 
strategy  to  resolve  the  conflict,  and  defines  specific  clearances 
and  advisories  to  Implement  the  resolution  strategy. 


Flight  Information  Decision-Making  Process 

23.  Search  for  a flight  Information  service  actlon--A 

24.  Determine  specific  clearances  and  advisories  to  provide  flight 
Information  service — A 


The  computerized  control  message  automation  Identifies  all 
specific  clearances  and  advisories  required  by  the  aircraft  to 
proceed  along  their  flight  paths  (If  such  Information  has  not 
} been  determined  as  part  of  the  separation  assurance  process). 


Control  Message  Transmission  Process 

28.  Issue  clearances  and  advlsorle8--A 

The  computer  automatically  transmits  digitized  control  Instruc- 
tions to  data-llnk-equlpped  aircraft. 

30.  Relay  clearances  and  advisories — M 

The  controller  receives  electronically  displayed  message  Instruc- 
tions, communicates  by  voice  with  pilots  of  an  occasional  non- 
data-llnk  aircraft  or  retransmits  messages  that  could  not  be 
completed  successfully  by  data  link,  and  updates  computer  records. 


91 


Appendix  G 

RATING  FACTORS  AND  FACTOR  SELECTION  PROCEDURE 
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Appendix  G 


RATING  FACTORS  AND  FACTOR  SELECTION  PROCEDURE 


Rating  Factors 

Job  Satisfaction  and  Motivation 


Factor  1:  Achievement — Work  Alignment 

Work  alignment  refers  to  the  feeling  of  achievement  associated  with 
performing  a task  that  is  perceived  to  fit  in  with  the  end  goal  of  the 
ATC  system.  This  Implies  that  the  function  is  neither  "paper  work," 
"make-work,"  nor  concerned  with  the  care  of  ATC-assoclated  machinery  or 
systems,  but  directly  concerned  with  controlling  traffic. 

A high  rating  indicates  your  feeling  that  the  function  is  directly 
associated  with  the  main  purpose  of  the  ATC  system.  A lor-^  rating  in- 
dicates that  the  controller  will  not  be  able  to  directly  relate  his  per- 
formance of  the  function  to  ATC. 


Factor  2:  Recognition 

Recognition  refers  to  the  perceived  credit  received  by  an  individual 
controller  for  th>!i  performance  of  a particular  function. 

A high  rating  here  Indicates  that  the  function  permits  task  per- 
formance visibility  or  credit  for  adequate  or  superior  job  performance. 

A low  rating  indicates  that  the  function  provides  no  mechanism  for  in- 
dividual visibility,  credit,  or  identity  for  average  or  superior  job 
performance. 


Factor  3:  Responsibility 

Responsibility  refers  to  the  sense  of  personal  accountability  for 
the  success  or  efficient  execution  of  a function.  While  it  is  not  meant 
to  imply  that  shared  responsibility  is  a negative  quality,  it  is  desired 
to  Identify  the  system  configurations  in  which  the  controller  will  per- 
ceive shared  responsibility  with  the  machine. 

A high  rating  on  responsibility  indicates  that  the  function  provides 
task-oriented  accountability  and  responsibility  on  an  individual  basis. 

A low  rating  indicates  that  the  function  does  not  allow  for  task  accounta- 
bility on  an  individual  basis. 
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Factor  4;  Control  Authority 

Control  authority  means  being  able  to  take  the  necessary  steps  to 
see  that  a required  action  Is  taken  or  that  a required  decision  Is  made. 
This  Is  akin  to  responsibility;  however,  here  we  are  concerned  with  the 
means  that  a controller  has  for  performing  his  functions  and  the  authority 
given  to  him  for  making  decisions  and  taking  action. 

A high  rating  Indicates  that  the  function  involves  the  necessary 
control  authority  for  performing  assigned  tasks  and  meeting  responsibili- 
ties. A low  rating  indicates  that  this  necessary  control  authority  Is 
not  provided  in  regard  to  the  function.  This  implies,  for  Instance, 
that  there  Is  a perceived  action  to  be  taken  or  decision  to  be  made, 
but  the  system  configuration  does  not  allow  the  controller  to  do  It  him- 
self, or  to  ensure  that  It  gets  done. 

Factor  5:  Utilization  of  Perceived  Skills 

The  utilization  of  skills  means  that  the  function  requires  or  allows 
the  controller  to  use  the  relevant  and  valued  skills  he  perceives  he 
brings  to  the  situation.  Such  skills  may  represent  both  acquired  (i.e., 
learned)  and/or  native  ability. 

A high  rating  indicates  that  the  function  requires  or  allows  the 
controller  to  apply  relevant  valued  skills  to  ATC.  A low  rating  Indi- 
cates that  the  function  requires  minimal  or  no  use  of  valued  skills. 

Factor  6:  Challenge  (Discretionary  Flexibility 

Challenge  or  discretionary  flexibility  Is  the  degree  to  which  a 
function  permits  a controller  to  exercise  judgment  In  the  selection  of 
response  options. 

A high  rating  indicates  that  the  function  permits  variety,  dis- 
cretion, flexibility,  or  creativity  In  its  execution.  A low  rating 
Indicates  that  the  function  provides  a rigid  task  environment  allowing 
for  no  discretion,  flexibility,  or  creativity  In  Its  execution. 


Factor  7:  Performance  Feedback 

Performance  feedback  refers  to  the  indications  avallsc>'.v  ’ ' ri« 

controller  as  to  the  effectiveness  of  his  performance  of  the  ? .i. 
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Factor  8:  Interest 


Interest  means  that  the  function  is  stimulating  or  interesting,  it 
is  the  opposite  of  boredom. 

A high  rating  indicates  that  the  function  is  interesting  or  highly 
motivating.  A low  rating  indicates  that  the  function  is  uninteresting, 
boring,  or  must  be  performed  in  a manner  that  does  not  simulate  motiva- 
tion. 


Man-Machine  Interface 


Factor  9:  Vigilance 

Vigilance  refers  to  the  frequent  or  constant  attention  required  of 
the  controller  to  detect  infrequently  occurring  events  over  relatively 
long  periods  of  time. 

A high  rating  indicates  Chat  the  system  is  configured  such  that 
excessive  vigilance  is  not  required.  A low  rating  indicates  Chat  per- 
formance of  the  function  requires  excessive  vigilance  of  the  controller 
(i.e. , unaided  by  his  equipment). 


Factor  10;  Stress 


As  used  herein,  stress  is  a psychological  variable  resulting  from 
such  causes  as  emotional  strain,  severe  time  constraints,  workload,  and 
responsibilities. 

A high  rating  on  stress  indicates  that  Che  function  performed  by 
Che  controller  in  the  system  at  issue  produces  relatively  little  emo- 
tional strain.  A low  rating  indicates  that  the  function  causes  severe 
emotional  strain. 


Factor  11:  Intricacy 


Intricacy  is  the  level  of  activity  required  by  the  function  as  well 
as  its  reliance  on  awkward  or  complex  procedures. 

A high  rating  indicates  that  execution  of  the  function  is  straight- 
forward, requiring  minimal  manual  activity  or  complexity  in  Che  inputting 
of  data  or  executing  procedures.  A low  rating  indicates  that  the  func- 
tion is  executed  by  complex  or  awkward  procedures..  It  requires  prolonged 
operation  interaction  or  adherence  to  an  intricate  sequence  of  activities. 
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Factor  12;  ReatrictlveneBS 


Raatrictlveness  refers  to  the  inability  of  the  controller  to  perform 
parallel  or  simultaneous  functions,  tasks,  or  activities.  A restrictive 
function  Is  one  that  requires  the  full  attention  of  the  controller  and 
doea  not  permit  parallel  execution  of  another  function  or  task  (such  as 
scanning  the  PVD) . Another  kind  of  restrictive  function  la  one  that  re- 
quires the  simultaneous  performance  of  an  excessive  number  of  actions. 

The  net  result  of  a restrictive  function  Is  that  the  controller  Is  much 
reduced  In  his  ability  to  respond  to  stimuli  or  situations  during  the 
performance  of  It. 

A high  rating  In  restrictiveness  Indicates  that  the  function  permits 
the  parallel  or  simultaneous  execution  of  other  functions,  tasks,  or 
activities.  The  execution  of  one  function  does  not  unduly  Interfere 
with  that  of  another.  A low  rating  Indicates  that  the  function  requires 
the  simultaneous  performance  of  an  excessive  number  of  tasks  or  the  per- 
formance of  functions  or  tasks  that  Interfere  with  each  other. 


Factor  13;  Rigidity 

Rigidity  refers  to  Inflexibility  In  the  order  of  executing  tasks 
and  to  the  time  criticality  of  execution.  A flexible  function  allows 
the  controller  an  opportunity  to  order  the  tasks  involved  to  be  executed 
In  a specified  time  frame  (e.g. , a task  can  be  delayed  In  order  to  devote 
attention  to  more  critical  tasks).  A function  Inflexible  In  execution 
mandates  a rigid  sequence  or  order  In  which  the  tasks  must  be  performed. 

A high  rating  In  rigidity  Indicates  a function  with  high  flexibility, 
one  In  which  the  controller  has  some  autonomy  and  need  not  respond  Im- 
mediately to  each  stimulus  or  machine  action.  A low  rating  Indicates 
that  the  controller's  work  Is  more  tied  to  external  events  or  the  actions 
taken  by  the  machine;  his  work  Is  substantially  driven  or  forced. 


Factor  14:  Decision  Making 

Decision  making  refers  to  the  Identification  and  selection  of  alter- 
natives. Such  a situation  could  arise  as  a result  of  a choice  presented 
by  the  machine  to  the  controller,  as  a result  of  a controller-initiated 
activity,  or  as  a result  of  an  external  event,  such  as  an  A/G  communication 
or  emergency.  This  rating  refers  to  the  nature  of  the  Information  pro- 
vided to  the  controller  by  the  system  and  the  difficulty  In  using  this 
for  making  decisions. 

A high  rating  Indicates  that  decisions  can  be  made  In  a straight- 
forward manner,  with  appropriate  Information  and  alternatives  available 
to  the  controller.  A low  rating  Indicates  that  decision  making  Involving 
the  function  Is  difficult.  The  controller  may  have  available  only  ag- 
gregated or  raw  Information  to  assist  him  or  the  controller  must  have 
access  to  a substantial  amount  of  data  or  perform  time-pressured  calcula- 
tions. 
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Failure  Mode  Operatlona 


Factor  IS;  Failure  Recognition 

Failure  recognition  refers  to  your  Judgment  of  the  ease  of  recogniz- 
ing the  failure  of  a particular  piece  of  machinery,  algorithm,  or  auto- 
BMtlc  procaas  that  prevents  the  function  from  being  performed.  For  rating 
purposes  assume  that  a failure  has  occurred  that  affects  only  the  func- 
tion being  rated.  ' 

A high  rating  on  recognition  Indicates  that  the  ATC  system  provides 
enough  feedback  or  redundancy  to  announce  the  failure  In  question. 

A low  rating  Indicates  chat  the  failure  may  not  be  recognized  at  all  or 
until  a critical  situation  develops. 


Factor  16:  Failure  Recovery 

This  refers  to  your  Judgment  of  the  ease  and  efficiency  of  recovering 
from  failure.  Assume  for  rating  purposes  that  a failure  has  occurred 
affecting  only  the  function  In  question  (and  has  been  recognized). 

A high  rating  here  means  that  the  loss  of  Information  can  be  easily 
and  quickly  recovered  through  appropriate  manual  activity.  A low  rating 
Indicates  that  the  system  function  Is  so  critical  that  recovery  from 
failure  Is  very  difficult,  time  consuming,  or  time  pressured.  Note  that 
thla  category  does  not  refer  to  ATC  operations  after  recovery  has  been 
affected  and  activities  have  settled  down  to  a "steady-state,"  but  only 
to  the  Immediate  recovery  from  a failure  detection. 


Factor  17:  Failure  Operations 

Failure  operations  refers  to  your  Judgment  of  the  quality  of  ATC 
operations  after  a failure  has  occurred.  This  means  that  a malfunction 
or  failure  has  occurred  and  been  detected,  and  whatever  necessary  has 
already  been  done  to  compensate  for  the  failure. 

A high  rating  Indicates  that  the  failure  In  question  has  little  or 
no  Impact  on  ATC  operations  In  that  system.  A low  rating  Indicates  that 
the  system  does  not  easily  allow  for  manual  control  transfer  or  capability 
of  overriding  automatic  function.  Overall  ATC  operations  are  disrupted 
because  of  system  Inefficiency  or  performance  degradation  (less  traffic 
can  be  handled). 


Factor  Selection  Procedure 

The  17  factors  were  chosen  from  a group  of  approximately  30  candidate 
factors.  Some  factors  were  eliminated  to  reduce  the  amount  of  work  re- 
quired of  each  rater  and  to  avoid  overlapping  among  factors.  Other  fac- 
tors wore  eliminated  during  pretesting  at  SRI  either  because  they  could 
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not  be  related  directly  to  the  ATC  systems  or  because  they  could  not  be 
easily  distinguished  from  one  another. 

The  factors  that  were  retained  overlap  somewhat.  This  Is  Inevitable 
due  to  the  lack  of  precision  In  the  English  language.  It  Is  an  acceptable 
psychological  testing  practice  to  Include  similar  factors  as  a consistency 
check.  In  addition,  the  list  of  factors  Is  by  no  means  complete.  Whole 
categories  of  man/machlne  Interface  factors  that  pertained  to  purely 
technological  mechanizations  were  excluded.  For  example,  each  of  the 
six  systems  under  consideration  uses  a CRT  display.  However,  no  system 
can  profitably  be  rated  on  such  factors  as  CRT  brightness  or  Information 
content,  both  of  which  can  be  Influenced  by  engineering  or  software  changes 
totally  unrelated  to  automation  and  Its  basic  effects. 


Rating  Instructions 

The  packet  of  information  given  to  the  raters  contained  the  follow- 
ing Items: 

• An  Instruction  booklet. 

• A rater  background  sheet. 

• A set  of  six  booklets  containing  systems  descriptions  for  the 
ATC  systems  to  be  rated. 

• Six  rating  sheets,  one  for  each  ATC  system  (Inverted  Into  the 
appropriate  system  booklet). 

• A booklet  of  factors  describing  the  criteria  on  which  to  rate 
the  six  systems. 


Rater  Background  Sheet 

The  rater  background  sheet  requested  Information  about  the  raters' 
ATC  background  and  experience.  It  was  used  for  both  follow-up  contacts 
and  statistical  purposes. 


System  Descrl ’,>tlon  Booklets 

Each  system  description  booklet  contained  information  about  a par- 
ticular ATC  system  ranging  In  sophistication  of  automation  from  the 
current  NAS/ARTS  system  (System  1)  to  Control-by-Exceptlon  Level  III 
(System  6).  Each  booklet  consisted  of  four  parts,  each  one  providing 
a more  detailed  description  of  the  system.  The  first  part,  a system 
operational  overview,  briefly  described  the  system  and  the  level  of 
automation  and  technology  It  embodies.  Following  this  was  a chart 
describing  control  process  roles  for  five  processes:  sector  traffic 
flow  planning,  aircraft  flight  planning,  separation  assurance  decision 
making,  flight  Information  decision  making,  and  control  message  trans- 
mission. The  chart  Identified  the  roles  of  both  the  controller  and  the 
automatic  machinery  In  performing  these  processes. 


100 


Parts  3 and  4 of  the  booklet  described  the  control  processes  in 
tcnas  of  30  generalised  control  functions.  The  third  part  of  each  system 
description  booklet  consisted  of  a list  of  control  functions  applicable 
to  that  particular  system  within  each  control  process.  Each  function  was 
marked  with  an  M (human)  or  an  A (automation).  Not  all  30  functions 
were  represented  in  each  system;  the  functions  not  applicable  to  the  par- 
ticular system  were  not  included  in  the  booklet  for  that  system.  The 
fourth  part  of  the  booklet  was  simply  a more  detailed  description  of 
each  control  function.  It  was  anticipated  that  the  raters  would  read 
Part  4 of  each  booklet  before  they  began  to  score  each  system,  and  that, 
as  they  progressed  through  the  system,  they  would  need  to  refer  only  to 
Parts  2 or  3. 


Rating  Sheets 

Each  of  the  six  systems  had  a rating  sheet  (see  Appendix  H).  At 
the  top  of  each  sheet  was  the  system  number  and  its  title.  Each  sheet 
contained  a list  of  the  30  general  control  functions  broken  down  into 
the  five  control  processes.  The  data  were  the  same  for  each  of  the  six 
systems.  Each  control  function  represented  in  the  system  is  described 
with  an  M (man)  or  an  A (automation). 

The  17  factors  by  which  each  system  was  rated  were  listed  along  the 
top  of  the  racing  sheet.  These  factors  are  divided  into  three  general 
areas:  achievement  and  satisfaction,  man-machine  interface,  and  post- 
failure operations.  Descriptions  of  all  of  these  factors  could  be  found 
in  Che  system  factors  booklet  (see  below).  System  ratings  were  Co  be 
placed  in  Che  boxes  at  the  center  of  the  rating  sheet.  The  scores  put 
in  a box  applied  to  Che  control  function  on  the  same  line  as  the  box  and 
the  factor  in  the  same  column  as  the  box.  Some  boxes  applied  to  more 
chan  one  control  function,  and  Che  score  put  in  such  a box  was  understood 
to  apply  to  all  control  functions  covered  by  that  box.  The  absence  of 
a box  for  a particular  control  function  or  factor  indicated  either  that 
the  control  function  was  not  present  in  that  particular  system  or  that 
a score  was  not  desired  for  that  particular  factor. 

At  the  right  of  each  line  of  boxes  extending  under  the  failure  mode 
operations  factors  was  a description  of  what  particular  item  was  to  be 
considered  as  having  failed  for  that  racing.  Below  Che  rating  boxes  was 
a description  of  the  scoring  metrics  (rating  scales)  used  for  each  fac- 
tor. AC  Che  very  bottom  of  each  rating  sheet  was  an  area  in  which  Che 
raters  were  encouraged  to  comment  on  anything  Chat  could  not  be  described 
by  a single  rating. 


System  Factors  Booklet 

The  system  factors  booklet  contained  write-ups  for  each  of  the  17 
factors.  The  write-up  for  each  factor  contained  a short  definition  of 
Che  factor  and  a description  of  what  high  and  low  ratings  mean.  Recall 
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that  in  all  cases  a high  rating  indicates  a "better"  system  chan  a low 
rating,  and  ratings  from  1 to  5 were  to  be  assigned  according  Co  Che 
scales  prlnCed  on  Che  racing  sheeca.  AddiCional  scoring  InsCruccions 
given  Co  Che  racers  are  described  below. 


Racing  Guidelines  for  Job  Satisfaction  and  MoCivaCion 
and  Man-Machine  Interface  Factors 


The  14  Job  satisfaction  and  motivation  and  man-machine  interface 
factors  were  rated  using  the  rating  metric  (rating  scale)  under  Che 
factor  being  considered.  One  metric  was  used  for  Che  Job  satisfaction 
and  mocivacion  factors,  and  two  for  Che  man-machine  interface  factors. 
The  human  (H)  functions  were  to  be  rated  as  if  the  rater  were  Che  con- 
troller performing  them.  The  raters  were  cautioned  that  there  is  more 
to  rating  a function  than  simply  considering  that  function  alone;  each 
function  had  to  be  considered  in  the  context  of  the  particular  system. 
Both  controller  workload  and  the  division  of  tasks  between  man  and 
machine  inherent  in  Che  system  also  had  Co  be  taken  into  account.  For 
instance,  when  rating  Che  factor  "rigidity,"  consideration  of  the  time 
criticality  of  the  function  required  that  Che  rater  be  aware  of  what 
Casks  were  being  performed  by  the  man  at  approximately  the  same  time 
and  what  Casks  were  being  handled  by  the  computer.  The  rating  given 
Co  a particular  function  for  Che  rigidity  factor  might  vary  considerably 
depending  on  Che  perception  of  the  controller  workload  inherent  in  Che 
system. 

Automation  (A)  functions  were  to  be  rated  only  for  some  selected 
factors  within  Che  Job  satisfaction  and  motivation  category:  recogni- 
tion, responsibility,  skill  utilization,  challenge,  and  Interest.  The 
raters  were  asked  to  Judge  Che  change  in  rating  from  a previous  system 
where  the  automatic  function  was  performed  manually.  Therefore,  there 
were  two  versions  of  the  rating  metric  for  Job  satisfaction  and  motiva- 
tion factors:  one  for  manuslly  performed  and  one  for  automatically  per- 
formed functions.  The  second  definition  of  the  metric  referred  to  the 
perceived  change  in  the  factor  rating  due  to  automating  the  function. 

Vigilance  and  stress  were  the  only  factors  within  the  man-machine 
interface  category  that  were  rated  for  automated  tasks.  These  factors 
could  be  rated  by  the  same  metric  as  that  used  for  manually  performed 
functions  with  the  understanding  that  the  controller  need  no  longer 
perform  a particular  function. 


Rating  Failure  Mode  Operation  Factors 

Only  certain  functions  were  to  be  rated  with  respect  to  failure  mode 
operation  factors.  Next  to  esch  set  of  boxes  in  the  failure  mode  factor 
columns  was  a description  of  the  failed  component  group,  algorithm,  or 
process. 
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Appendix  H 
RATING  FORMS 


I 


R/^TING  FORM  ERRATA 


System 

Function 

Factor 

Corrective  Action 

1 

7 

Vigilance 

Delete  scoring  box 

2 

8 

Vigilance 

Add  scoring  box 

3 

28 

Vigilance 

Delete  scoring  box 

4 

30 

Alignment 

Delete  scoring  box 

5 

6 

Alignment 

Delete  scoring  box 

Results  presented  in  this  report  are  based  on  the 
uncorrected  rating  sheets. 
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W^KPIMa  BAOE  RIAMUMOT  fllMSft 


NAS 


BEST  AVAIIABIE  COPY 


SYSTEM  3 : TERMINAL  DECISION  AID 


CONTROL  BY  EXCEPTION 


I 


SYSTEM  5:  CONTROL  BY  EXCEPTION  L£Va  2 


SYSTEM  6 : CONTROL  BY  EXCEPTION 


Appendix  I 
RATING  DATA  SUMMARY 
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Appendix  J 

BIAS  ADJUSTMENT  CALCULATIONS 


A MCheaatlci.1  statement  of  the  bias  manipulations  follows: 

Is  the  k'th  rater's  score  for  the  I'th  factor  and 

the  J ' th  function  of  the  I'th  system. 

b is  the  averase  score  for  the  I'th  factor  by  the  k'th 

Ik 

rater. 

N is  the  set  of  raters  scoring  item  l,j»l> 

ijl 

jN^jj^j  Is  the  nunber  of  raters  In 


is  the  entry  of  the  I'th  row,  j'th  coluan  of  Table  1. 


cjj  Is  the  entry  of  the  I'th  row,  I'th  coluan  of  the 

(unbiased)  comparison  table  for  Table  1. 

For  two  systese  1 and  1'  of  Table  t's  J'th  column  we  have: 


A 

In r ^ 

Tijll  keN^j^ 


liSt  n 


"ijil 


(15 


raw  not  au«jioT  nu^ 


Than,  for  the  "unbiased"  scores, 


1 

n 

E (r 

kcN^jl 

IJkl  - '’ik 

1 

n 

E^lc 

kcMiji 

^I'J 

- 

f 

where  Is-  the  average  score  (over  the  raters  In  for  factor  1. 

Similarly: 


-(i)  , -(1)  t; 

^I’J  ^I'j  ■ **11' 

Ue  see  that  comparing  with  is  equivalent 


.(1) 


with  C^,j  if  and  only  if  , and  we  can 

**ljl  " **1J1'  systems  are  rated  by 

factor  i) . 


to  comparing 

be  sure  of  that  only 
the  same  raters  for 
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